Target
- Customers who have not configured a DMARC record for the email domains used with Email DLP
Purpose
DMARC is a security mechanism that allows you to determine whether the sender address displayed in an email has been spoofed (Domain-based Message Authentication, Reporting, and Conformance).
It is one of the email authentication technologies, and by verifying the sender address (Header From) displayed in the email based on the authentication results of SPF and DKIM, it helps prevent spoofing and ensures that emails are sent from trusted domains.
In addition, the DMARC policy allows you to determine how emails are handled after being checked against SPF and DKIM records.
By using Domain Protection, you can effectively visualize and analyze DMARC reports.
[Domain Protection] Service Overview
* If you are not using Domain Protection, or if you wish to configure DMARC records without using Domain Protection, please select "If not using Domain Protection" from the Procedure tab.
Notes
- It is recommended to perform this procedure for all custom domains used for email.
- You must have already added an SPF record and configured DKIM in advance.
- Since HENNGE cannot access your network's DNS settings, your domain administrator or domain management service provider may need to perform some steps to complete this procedure.
- The configuration described in this Help Center article is the minimum DMARC setup required to comply with the guidelines published by Microsoft or Google.
The guidelines recommend specifying p=none as the DMARC policy to monitor emails that fail authentication. - The content of this article is based on the product as of October 2026 and is subject to change without notice.
Procedure
Adding a DMARC Record
If using Domain Protection
By using Domain Protection, you can effectively visualize and analyze DMARC reports.
After logging in to Domain Protection, you need to generate a DMARC record.
1. Log in to Domain Protection.
For instructions on how to log in, please refer to the following article.
[Domain Protection] How to Log In to the Administration
2. Issue a DMARC record from the Domain Protection Administration.
For instructions on how to issue a DMARC record, please refer to the following article.
[Domain Protection] Issuing a DMARC Record
3. After issuing the DMARC record, publish the DMARC record to the DNS of the domain you are using.
* The method for adding a TXT record on the DNS server varies depending on the server.
Please check with your DNS service provider for details.
If not using Domain Protection
1. Publish the following DMARC record to the DNS of the domain you are using.
* The method for adding a TXT record on the DNS server varies depending on the server.
Please check with your DNS service provider for details.
Name of TXT record
* Depending on the DNS service, the trailing "." (dot) may not be required.
In that case, configure the record without the dot.
_dmarc.Value of TXT record
* "p=none" means that emails that fail authentication will still be delivered by the receiving server.
v=DMARC1; p=noneExample configuration
* Tags such as "rua" are not required.
* For the meaning of each tag, please refer to the Google site or Microsoft site.
v=DMARC1; p=none; rua=mailto:dmarc@example.comVerifying the DMARC Record
Please perform the following steps for all domains where DKIM has been added.
-
In the Email DLP Administration, go to [Tenant Settings] – [DMARC Coverage Dashboard].
- Confirm that the status of the domain where DMARC was added is as follows:
- Status: Partially Compliant or Compliant
- DMARC: Enabled
- DKIM: Enabled
- SPF: Enabled
For more details on how to check the [DMARC Coverage Dashboard] screen, please refer to the following article.
[Email DLP] How to Check and Correct the DMARC Coverage Dashboard
Frequently Asked Questions
How can I strengthen the DMARC policy?
Please refer to the following article.
About Strengthening the DMARC Policy