Microsoft 365 - Publishing a Custom DMARC Record for Your Email Domain in DNS

Preparing to publish your custom DMARC record

Before you publish a custom DMARC record for your email domain, you'll want to make sure your domain's SPF record in DNS includes all of the senders you approve to send email as/from your domain and that it ends with "~all" or "-all".

1. Use the DMARC Info tool in the Wisc Account Admin Site to view IP addresses sending as/from your domain over the past several days and stage potential changes to your domain's SPF record.

2. Reach out to any and all third-party email vendors your organization contracts with and request that they work with you to set up custom domain authentication via SPF and DKIM for your subdomain (e.g. mydomain.wisc.edu). Steps for how to do this with some of campus's commonly used third-party email vendors are below:

   • Office 365 - Approve Campaign Monitor to Send DMARC-Compliant Email from My Domain

   • Office 365 - Approve ClickDimensions to Send DMARC-Compliant Email from My Domain

   • Office 365 - Approve Constant Contact to Send DMARC-Compliant Email from My Domain

   • Office 365 - Approve Emma to Send DMARC-Compliant Email from My Domain

   • Office 365 - Approve iContact to Send DMARC-Compliant Email from My Domain

   • Office 365 - Approve MailChimp to Send DMARC-Compliant Email from My Domain

   • Office 365 - Approve SendGrid to Send DMARC-Compliant Email from My Domain

     • If your third-party email vendor/service is not listed above, you may be able to find them listed with links to their DMARC-related documentation here: https://dmarc.io/sources/.

Publishing your custom DMARC record

Once your domain's SPF record in DNS has been updated to include only senders you approve to send as/from your domain, and you've taken steps to set up custom domain authentication via DKIM for any/all third-party email vendors that send as/from your domain, you may take the next steps to publish a custom DMARC record for your email domain in DNS however you normally publish DNS records or request their publication.

DMARC record publication location

Publish a TXT record in DNS at the following location, replacing yourdomain.wisc.edu with the domain for which you'd like the record published:

_dmarc.yourdomain.wisc.edu

Different options for publishing your custom DMARC record

• Effective Quarantine Record

• Use the following value when publishing the DMARC record so that it instructs recipient mail systems to quarantine messages that fail your DMARC policy and provide failure reports to UW-Madion's mail system administrators:

  "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@wisc.edu; ruf=mailto:dmarc-forensics@wisc.edu; fo=1; sp=none;"

  Note: to change the percentage of quarantined failed messages, change the value in the "pct=" tag in the record to any value between 0 and 100.

• Reject Record

• Use the following value when publishing your DMARC record so that it instructs recipient mail systems to reject messages that fail your DMARC policy and provide failure reports to UW-Madison's mail system administrators:

  "v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@wisc.edu; ruf=mailto:dmarc-forensics@wisc.edu; fo=1; sp=none;"

  Note: to change the percentage of rejected failed messages, change the value in the "pct=" tag in the record to any value between 0 and 100.

See Also:

• Microsoft 365 - DMARC Consultation & Information Requests
• Microsoft 365 - Steps to make UW-Madison email DMARC compliant
• Microsoft 365 - DMARC Info tool