How to set up DMARC for bulk email

Updated October 31, 2026 · 2 min read

In this article
  1. Do you need DMARC
  2. How to add the record
  3. Which policy to choose
  4. The main rule: strict DMARC only with DKIM
  5. How to check
  6. What's next

DMARC is a DNS record that tells providers what to do with emails from your domain that fail SPF and DKIM checks: deliver them, send them to "Spam" or reject them. Your account suggests a TXT record with the name _dmarc and the value v=DMARC1; p=reject;. Add it once the domain already has the Estismail DKIM working.

Do you need DMARC

Provider What it requires
Gmail DMARC is mandatory for anyone sending 5,000 or more emails a day to Gmail; the policy p=none is enough (Google's sender guidelines, October 2026)
Mail.ru SPF, DKIM and DMARC must all be set up (Mail.ru sender help, updated December 6, 2023)
Yandex DMARC is recommended; DKIM and SPF are called mandatory (Yandex help "Sending many emails", October 2026)

In Estismail, DMARC is not needed to verify a domain: DKIM or SPF verifies it. If there is no DMARC record, the row in your account is gray: "Optional. Recommended: protects your domain from spoofing". It is still worth setting up, since Gmail and Mail.ru expect it.

How to add the record

If the domain has no DMARC record, create this in the DNS panel:

Type Name Value
TXT _dmarc v=DMARC1; p=reject;

If the domain already has a DMARC record, do not create a second one: a domain must have one _dmarcrecord, otherwise your account shows "Multiple DMARC records, keep one". If something is wrong with the record, your account shows under the row what is currently in DNS.

For the subdomain news.company.com your account shows the same name _dmarc. In the DNS panel of the main domain, enter _dmarc.news.

Which policy to choose

Policy What the provider does with a message that failed the check Label in your account
p=none only observes, delivers the message as usual yellow: "p=none does not protect the domain, we recommend p=reject"
p=quarantine puts it in "Spam" green, if DKIM works
p=reject rejects it green, if DKIM works

If the domain sends email only through Estismail, use p=rejectas your account suggests. If other services also send on behalf of the domain (corporate mail, CRM, website), start with p=none: the label will be yellow, but other services' emails will not suffer. Tighten the policy once you are sure all those services have DKIM or SPF set up.

To receive provider reports, add an address to the record: v=DMARC1; p=none; rua=mailto:dmarc@company.com. Reports arrive at this address as files; dedicated services make them easier to read.

The main rule: strict DMARC only with DKIM

If the domain has p=quarantine or p=rejectand there is no Estismail DKIM record in DNS, providers will reject or send to "Spam" emails from this domain. This has happened: a domain had p=reject, no DKIM record, and Mail.ru rejected every email in the campaign. In that case your account shows the DMARC label in red: "without DKIM: emails will be rejected, set up DKIM".

So:

  1. First add the DKIM record and wait for the green label in your account.
  2. Only then launch the campaign or tighten DMARC.

How to check

  • In your account, the domain's DMARC label is green.
  • The "Check again" button checks the records immediately.

What's next

Was this article helpful?
Next articleMailbox providers: requirements and server replies →