Hosted DMARC

Hosted DMARC lets you manage your DMARC policy from the Suped dashboard. Instead of editing TXT records in your DNS provider, you point a CNAME to Suped and control everything from the UI.

Hosted DMARC supports record options from the updated DMARC specification (RFC 9989), including np, psd, and t. Support for these tags varies between receiving mail servers.

How it works

Suped hosts your DMARC record behind a CNAME. When receivers look up _dmarc.yourdomain.com, the CNAME resolves to Suped's infrastructure, which serves the DMARC record you've configured in the dashboard.

Setup

1. Go to Domains
2. Click the three-dot menu on your domain row and select Configure DMARC
3. Enable hosted DMARC
4. Add a CNAME record in your DNS:
   • Host: _dmarc.yourdomain.com
   • Value: The alias shown in your Suped dashboard
5. Suped will verify the CNAME and activate hosted DMARC

Managing your policy

Once hosted DMARC is active, you can change your DMARC policy directly from the dashboard:

• None - Monitor only. Unauthenticated emails are delivered normally.
• Quarantine - Unauthenticated emails are sent to spam.
• Reject - Unauthenticated emails are blocked entirely.

Changes take effect immediately since the CNAME stays the same - only the record Suped serves behind it changes.

Automatic reporting

When you enable hosted DMARC, Suped is automatically added as a reporting destination in the rua tag. You don't need to manually configure reporting addresses.

Advanced policy options

Open Advanced options when configuring DMARC to set:

• Non-existent subdomain policy (np) - Choose none, quarantine, or reject for non-existent subdomains of your organizational domain (DNS returns NXDOMAIN). If omitted, it inherits sp, then p.
• Public suffix domain (psd) - y identifies a public suffix domain; n identifies a domain that is not a public suffix and is the organizational domain for itself and its subdomains. Omitted or u leaves organizational-domain discovery to the receiver. Only public suffix operators should use y.
• Testing mode (t) - y requests that reject be treated as quarantine, and quarantine as none, for the applicable p, sp, or np policy. A none policy and reporting are unchanged. Omitted or n requests normal enforcement.

Older receivers may ignore t and apply the published policy. Testing mode does not guarantee that failing messages will be delivered.

Policy staging

Use monitoring and source remediation before moving to stricter policies, rather than percentage-based application:

1. Start with p=none and review DMARC reports to identify legitimate sending sources
2. Fix legitimate sources so they produce an aligned SPF or DKIM pass
3. Move to p=quarantine and monitor the results
4. Once remaining legitimate-source issues are resolved, move to p=reject

The updated DMARC specification (RFC 9989) removes pct (policy sampling percentage), ri (requested reporting interval), and rf (failure report format). Receivers following it ignore these legacy tags. Leave the Percentage and Reporting interval fields empty to omit them, and avoid adding rf to new records. Testing mode is not percentage sampling, and neither pct nor t should be relied on to prevent delivery failures.