Hosted DMARC and SPF Records

With hosted records, DMARC Examiner publishes the DMARC and SPF records of a domain. The domain points to our records once. After that, you change the policy and keep the SPF up to date from DMARC Examiner, without touching the DNS of the domain again.

Plan: hosted records are part of the Enterprise plan. Each hosted domain adds the hosted-records surcharge of your agreement. See Plans & Billing.

Host a record

  1. Open a domain and go to the Hosted records tab.
  2. Click Host on the DMARC or the SPF record. Owners, admins and members can do it.
  3. Set in the DNS of the domain the record that the tab shows:
    • DMARC: a CNAME record on _dmarc.yourdomain.com that points to the name we show. It replaces your current DMARC TXT record.
    • SPF: your SPF TXT record becomes v=spf1 include:<name we show> ~all. Your final all mechanism (~all, -all) stays as it was. If your record has no all, we use ?all.

When you host the DMARC record, we start from your current DMARC record and add our reporting address. If the domain has no valid DMARC record, we start from p=none. When you host the SPF record, we start from your current SPF record.

Record status

Status Meaning
Waiting for delegation Our record is published, but the DNS of the domain does not point to it yet.
Delegated The DNS of the domain points to our record.
Delegation removed The domain pointed to our record and no longer does. We create a critical alert.
Retiring Hosting was stopped. Our record stays published while you put back your own record.
Retired Our record was removed.

We check the delegation every hour.

A domain can be monitored by several organizations, but only one of them can host its records: the one the DNS of the domain points to. If another organization already hosts the domain, the tab tells you.

Change the DMARC policy

Click Change policy on the hosted DMARC record. Choose the policy (p), the subdomain policy (sp), the percentage (pct) and the DKIM and SPF alignment. Our reporting address always stays in the record, so the domain keeps sending its reports to DMARC Examiner.

The change is saved as a draft. Nothing changes in the DNS yet:

  • A member can create drafts, and discard their own drafts.
  • An owner or admin publishes the draft now or schedules it for a date within the next 90 days. Owners and admins can also discard any draft.

Before publishing, we check that the record still has the value the draft started from. If someone changed it in the meantime, the draft is cancelled and nothing is published.

All drafts of the organization are in DNS changes in the side menu, with the changes of each record before and after.

Revert a change

Every publication is saved in the Publication history of the domain, with its author and date. An owner or admin can click Revert on the last publication of a record. This publishes the previous value again, and is saved as a new publication.

SPF kept up to date

An SPF record can make at most 10 DNS lookups. Hosting keeps your SPF within that limit: we resolve every include, a, mx and redirect of your SPF record into IP ranges, so the record your domain publishes needs only one lookup to us. Your current record must resolve within 10 lookups and 500 IP ranges. If the result does not fit in one TXT record, we split it into up to 5 chained records.

Every 6 hours we resolve your SPF record again. When your providers change their IP ranges:

  • With Publish SPF updates automatically on (the default), we publish the new SPF record and email the owners and admins with the ranges added and removed.
  • With it off, the update waits as a draft for an owner or admin to publish it, and we email them.

If one of the includes cannot be resolved, we never publish: the last SPF record stays as it is. You can also click Regenerate SPF to check it now.

Some SPF records cannot be hosted, because their result depends on each email. For example, records with exists, ptr, macros (%{...}), mechanisms with a -, ~ or ? qualifier, or includes that end in +all. We tell you the reason when you try to host them.

Change the policy of many domains

MSPs can change the DMARC policy of many client domains in one step:

  1. In MSP console → Domains, select the domains. Filter by policy to find, for example, every domain still on p=none.
  2. Click Change policy and choose the change.
  3. We create one draft with a change for each domain whose DMARC record is delegated. Domains that cannot take the change are listed with the reason, for example Domain is not delegated to DMARC Examiner.
  4. Publish the draft from DNS changes, now or at a date. Reverting it restores the previous value of every domain in the draft. The revert is all or nothing: it is refused if a record changed after the publication or a domain no longer belongs to your clients.

If a domain stops belonging to one of your clients before the draft is published, the draft is cancelled and nothing is published.

Stop hosting

Click Stop hosting on a record. Only owners and admins can do it. The tab then shows the record you have to put back in the DNS of the domain.

Our record stays published until the DNS of the domain no longer points to it, for at most 30 days. We email the owners and admins of the organization, and of the MSP, on days 0, 7 and 23. After that we remove our record.

Hosting also stops in this way when a client is deleted or detached, or when the plan no longer includes hosted records.

Previous Bulk Operations Next Branding for Clients