Purpose
This post authenticates domain mail using DMARC for any domain to improve deliverability, visibility, and protection against spoofing and phishing.
DMARC configuration is performed only after mail is confirmed working. It relies on DKIM (and SPF) already being in place.
This post focuses on authentication and reporting—not mailbox setup or mail testing.
Scope and Applicability
- Applies to all domains on this server
- Performed first for the Account Domain
- Repeated for each additional domain added later
- Mail flow must already be confirmed functional
Prerequisites
- Mail sending and receiving has been successfully tested
- DKIM is enabled and confirmed for the domain
- SPF exists or is implicitly handled by the server
- No DMARC policy changes have been applied yet
Confirm DKIM Is Enabled
Before working with DMARC, confirm DKIM is still enabled and publishing correctly.
Use the canonical confirmation procedure:
If DKIM is not confirmed, stop and resolve the issue before continuing by reviewing How to Enable DKIM in DirectAdmin for Mail.
Test if a DMARC Record Exists
Check whether a DMARC record already exists for the domain.
Use the canonical testing procedure:
If a DMARC record exists, review it carefully before making changes. If it doesn’t exist, those steps are provided next.
Generate a DMARC Record
If no DMARC record exists, generate one now. This procedure adds a DMARC record to DNS.
Use the canonical procedure:
Initial DMARC policies should prioritize monitoring and reporting over enforcement. Allow time for DNS propagation before evaluating results. Be sure you test to confirm DMARC now exists as shown in the earlier step.
Verification
Confirm the following before proceeding:
- A DMARC record exists in DNS
- DMARC syntax validates successfully
- DKIM remains enabled and confirmed
- Mail sending and receiving continues to work
Stop Point
No additional mail authentication changes are required at this stage.
DMARC enforcement tuning and reporting analysis may be performed later, once sufficient mail traffic and reports are available.
Next step:
• Enable Security.txt (RFC 9116) on the DirectAdmin VPS, or confirm it is already enabled.
• Install Softaculous, if not yet done.
• If not done yet, create VPS System Backup (one-time safety checkpoint)
• If additional domains are planned, continue with adding another domain to the DirectAdmin VPS.
• Otherwise, transition into Maintenance & Operations for ongoing server management.