Guide
DMARC step by step
DMARC tells receiving mail servers what to do when SPF or DKIM alignment fails, and sends aggregate reports so you see who sends mail for your domain.
Before you publish DMARC
Fix SPF and DKIM for each legitimate sender first. Use the free mail check on our website or MailControl in My NovaMX to see missing or broken authentication.
Recommended order
- Publish SPF and DKIM for every service that sends mail for your domain (hosting, newsletter, ticketing, and so on).
- Add a DMARC record at p=none with rua pointing to a report address you control (MailControl provides hosted rua on NovaMX).
- Review aggregate reports for two to four weeks. Register unexpected senders or fix their authentication.
- Move to quarantine or reject only when legitimate traffic consistently passes alignment.
MailControl on NovaMX
After domain verification, MailControl Free gives one verified domain hosted DMARC monitoring with a short history. It is a good starting point before you order add-ons or bundles. You can run MailControl with NovaMX mail or with external DNS once the domain is verified.
What aggregate reports show
Aggregate reports (rua) arrive as XML summaries, usually daily. They list which IP addresses and services sent mail claiming your domain, whether SPF and DKIM aligned, and how your policy was applied. MailControl turns these into readable charts so you spot unexpected senders before you tighten policy.
Which product to choose
MailControl Free suits one verified domain with basic monitoring after verification. Managed DMARC (EUR 6.95/month per domain, excl. VAT) guides policy from monitor to reject without storing reports. DMARC Reports (EUR 7.95/month per domain, excl. VAT) ingests rua XML with source summaries and advice when you manage policy yourself. MailControl Essential (EUR 17.95/month) bundles SPF flattening, DMARC reporting and MTA-STS for two domains. MailControl Growth (EUR 89/month) fits several domains with longer history and BIMI certificate hosting included. In Preferences you can show prices with or without Dutch VAT (21%).
Common mistakes
Moving to p=reject or quarantine before all senders pass alignment blocks legitimate mail. Forgetting a newsletter or ticketing tool shows up in reports as a failing source you still need. Pointing rua to an inbox you never read hides problems until customers complain. Publishing DMARC before SPF and DKIM work adds noise without fixing delivery.
When you are stuck
Compare sources in MailControl or run the free mail check on our website to see which authentication step fails. Open Messages in My NovaMX if a paid tier should be active but DNS still looks wrong. We can review your domain and records with your permission.