Setting Up SentraDMARC, Step by Step

Setting up SentraDMARC means adding a few DNS records and then waiting a little. This walks through each screen, what you will see on it, and how long the parts you do not control usually take.

What you need before you start

You need an account on a plan or in its 14-day trial.

You also need access to wherever your domain’s DNS is managed. That is usually your registrar, sometimes your hosting company or a DNS provider.

If someone else holds that login, ask them to be available for step 2. Everything else you can do alone.

Step 1: add your domain

Type the domain you send mail from, such as yourcompany.com. If you paste a full address like https://yourcompany.com/, it is cleaned up for you.

Step 2: add the records

The next screen lists the records to create at your DNS host. Each has a copy button for the name and the value.

If you already have a DMARC record

If your domain already has a TXT record at _dmarc, delete it first. DNS does not allow a CNAME and a TXT at the same name, so most DNS hosts will refuse the new record until the old one is gone.

The screen shows you the record you have today. If it already enforces quarantine or reject, the screen warns you that ours starts at p=none, monitoring only.

You can then choose between switching now and keeping your own DMARC record for the moment.

Step 3: watch the rows turn green

We check each record at your DNS host’s own nameservers. A row turns green as soon as your DNS host is serving it, without waiting for copies cached elsewhere to expire.

Many DNS hosts publish a new record within minutes; some take an hour or longer. Mail servers elsewhere can take up to a few more hours to see the change.

You can close the page and come back.

When a record is wrong

A wrong record shows as wrong, not as “still waiting”. If a value does not match, the row says what it found and what it expected.

Two mistakes are common enough that the screen names them:

• A DNS host that adds your domain to the end of the value.
• A DNS host that adds your domain to the name a second time.

The second one turns the name into this:

Expected:  _dmarc.yourcompany.com
Found:     _dmarc.yourcompany.com.yourcompany.com

Fix the record, and the row updates on the next check.

Step 4: activate

Activation needs only the _dmarc record; the others can still be on their way. Press Activate.

If the _dmarc record is not visible yet, you are told so. Try again once its row is green.

When it works, you see Monitoring connected, with a list of which records are live and which are still being checked.

Your DMARC policy starts at p=none. Nothing is blocked; you are only watching.

Step 5: the SPF swap (Business and above)

On Business and Agency, the same screen offers one more record: SPF.

When you activated, we read the senders your current SPF record authorises. We carried them into a hosted SPF record of ours.

The card shows three things:

• The single record that replaces yours at @ TXT.
• Which senders it already includes.
• A live check that turns green when your nameservers serve it.

Why the swap comes after activation

Until then, our record does not exist. Pointing your SPF at it early would make SPF fail for every message you send.

The swap blocks nothing, and you can also do it later from the SPF page.

What to expect on the first day

Reports do not arrive straight away. Receiving servers send aggregate reports about once a day, covering the mail they saw from your domain, and only after they have seen some.

In practice the first reports usually appear within a day of your domain sending mail. Not every receiver sends them.

Until reports arrive, the dashboard says it is waiting rather than giving you a grade. A domain that has not been measured is not marked down.

If reports stop arriving for a week, the owner and admins get an email about it, so a silent domain does not go unnoticed.

Then the real work begins. The next post covers what to do with the first few weeks of reports. For your DNS host’s side of each record, see General DNS setup in the docs.