SentraDMARC

DNS records reference

Every record SentraDMARC can host, when you add it, and where its value comes from. The process is the same at any DNS host (GoDaddy, Cloudflare, Namecheap, OVH, Route 53…).

Five of the records are a single CNAME on your domain that points at a record we publish. SPF is the exception: a domain apex cannot be a CNAME, so you publish one TXT record at @ that points at ours. Either way you add each record once; after that its contents change from the dashboard.

The targets below are written [your-unique-link] because each one is specific to your domain. Copy the real value from the dashboard.

During setup

The setup wizard asks for these, and Activate needs only the first.

TypeHostValuePlan
CNAME_dmarcdmarc.[your-unique-link]All plans
CNAME_smtp._tlstls.[your-unique-link]All plans
CNAME_mta-stsmta.[your-unique-link]Business and above
CNAMEmta-stsThe policy host shown in your dashboardBusiness and above

After Activate

These depend on records we only publish once your domain is activated, so they are offered afterwards, each on its own page.

TypeHostValueWhere you get it
TXT@v=spf1 include:spf.[your-unique-link] ~all, or the redirect= formStep 3 of the wizard, or the SPF page. Replace your existing SPF record; never add a second. See Moving your SPF.
CNAME<selector>._domainkeydkim-<selector>.[your-unique-link]The DKIM page, after you paste your provider's DKIM record. See DKIM and selectors.
CNAMEdefault._bimibimi.[your-unique-link]The BIMI page, after your logo is uploaded and DMARC enforces on all mail. See BIMI.

Never add our SPF include before you activate. The record it points at does not exist until activation. An SPF record that includes a name that does not resolve is an error (RFC 7208 §5.2), and receivers fail SPF for every message you send until it resolves.

Common mistakes

  • The host field. Most DNS hosts want the name without your domain (_dmarc, not _dmarc.example.com). If yours adds the domain itself, typing it in full creates _dmarc.example.com.example.com. The wizard detects this and says so.
  • An existing _dmarc record. A name that carries a CNAME can carry nothing else, so delete your current _dmarc TXT first. Ours starts at p=none. If yours enforces, switching drops enforcement until you raise it again from the DMARC page, and stepping up needs reports on at least 10 of the last 14 days unless you confirm the risk. Or skip _dmarc for now and keep managing DMARC yourself.
  • Two SPF records. Two v=spf1 records at the apex are a permanent error, and receivers fail SPF for every message. Edit the one you have.
  • Two mta-sts records. _mta-sts (with the underscore) carries the policy version; mta-sts (no underscore) is the HTTPS host receivers fetch the policy from. You need both.
  • Propagation. A change reaches a resolver when the answer it cached expires. Records in our zone carry a 300-second TTL; the CNAME you add carries whatever TTL your DNS host sets.