DMARC record for Amazon Route 53

Does this page apply to you?

Run this first. Amazon Route 53 only matters if it is where your DNS or mail actually lives.

dig +short NS yourdomain.com

Expect: Names like ns-123.awsdns-45.com. They must match the public hosted zone you are editing; a private hosted zone is invisible to the internet.

Specific to Amazon Route 53

• The name is _dmarc and the value is wrapped in double quotes.
• The console default TTL is 300 seconds, which is fine for testing.
• If a subdomain is delegated to its own hosted zone, the receiver looks for _dmarc.sub.yourdomain.com first and falls back to the parent domain's record if it finds none.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  _dmarc  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

What the receiving server does with this record

When a message arrives, the receiver looks up _dmarc. plus the From domain. DMARC passes when SPF or DKIM passes and the domain that passed matches the From domain. If it fails, the p= policy decides what happens: none does nothing, quarantine sends it to spam, reject refuses it. Either way the receiver can email you an aggregate report.

Mistakes that break it

• Jumping to `reject`. Start at p=none, read the reports, fix every legitimate sender, then tighten. Enforcing before that loses real mail.
• Two DMARC records. Like SPF, a domain should have only one.
• Reports into your inbox. Aggregate reports arrive daily as zipped XML from every provider that saw your mail. Use a dedicated address or a report parser.
• A `rua` address on another domain. Reports to an external domain are only sent if that domain publishes a record authorizing it.

Gmail and Yahoo have required DMARC from bulk senders since 2024, at a minimum p=none. Build the record with the DMARC generator.

Check it from the command line

dig +short TXT _dmarc.yourdomain.com