Guide
DMARC step by step
DMARC tells receiving mail servers what to do when SPF or DKIM alignment fails, and sends aggregate reports so you see who sends mail for your domain.
Before you publish DMARC
Fix SPF and DKIM for each legitimate sender first. Use the free mail check on our website or MailControl in My NovaMX to see missing or broken authentication.
Recommended order
- Publish SPF and DKIM for every service that sends mail for your domain (hosting, newsletter, ticketing, and so on).
- Add a DMARC record at p=none with rua pointing to a report address you control (MailControl provides hosted rua on NovaMX).
- Review aggregate reports for two to four weeks. Register unexpected senders or fix their authentication.
- Move to quarantine or reject only when legitimate traffic consistently passes alignment.
MailControl on NovaMX
After domain verification, MailControl Free gives one verified domain hosted DMARC monitoring with a short history. It is a good starting point before you order add-ons or bundles. You can run MailControl with NovaMX mail or with external DNS once the domain is verified.
What aggregate reports show
Aggregate reports (rua) arrive as XML summaries, usually daily. They list which IP addresses and services sent mail claiming your domain, whether SPF and DKIM aligned, and how your policy was applied. MailControl turns these into readable charts so you spot unexpected senders before you tighten policy.
Which product to choose
MailControl Free suits one verified domain with basic monitoring after verification. Managed DMARC guides policy from monitor to reject without storing reports. DMARC Reports ingests rua XML with source summaries and advice when you manage policy yourself. MailControl Essential bundles SPF flattening, DMARC reporting and MTA-STS for two domains. MailControl Growth fits several domains with longer history and BIMI certificate hosting included. Current rates are on the Pricing page.
Common mistakes
Moving to p=reject or quarantine before all senders pass alignment blocks legitimate mail. Forgetting a newsletter or ticketing tool shows up in reports as a failing source you still need. Pointing rua to an inbox you never read hides problems until customers complain. Publishing DMARC before SPF and DKIM work adds noise without fixing delivery.
When you are stuck
Compare sources in MailControl or run the free mail check on our website to see which authentication step fails. Open Messages in My NovaMX if a paid tier should be active but DNS still looks wrong. We can review your domain and records with your permission.
When to move from p=none to quarantine or reject
Stay on p=none until aggregate reports show almost all legitimate senders passing SPF or DKIM alignment for two to four weeks. Then try p=quarantine for a short period so failures land in spam instead of vanishing. Move to p=reject only when unexpected sources are gone or fixed and you accept that failing mail will be refused.
Common questions
Can I jump straight to p=reject?
Usually no. Reject without clean reports blocks newsletter tools, CRM mail and other senders you still need. Start at p=none, fix sources, then tighten.
Does DMARC require NovaMX hosting?
No. After domain verification you can run MailControl while the website stays elsewhere. You publish the DNS records where your zone is hosted today.
What is rua?
rua is the mailbox or service that receives aggregate DMARC XML reports. MailControl can host that inbox so reports become readable charts instead of raw XML.
How do I order MailControl?
Create a My NovaMX account, verify your domain, then order MailControl. Contact us if you need help choosing a package.