Frequently Asked Questions

In traditional setups, deploying DMARC requires editing a static TXT record in your DNS provider every time you want to adjust policy, change rollout percentages, or update reporting addresses.

With Managed CNAME Delegation, you publish a single CNAME record on _dmarc.yourdomain.com pointing to your unique endpoint on dmarcify.top (for example d_a1b2c3d4e5._dmarc.dmarcify.top). Mailbox providers follow this CNAME to read your active policy. You can then progress from monitoring (p=none) to quarantine (p=quarantine) and rejection (p=reject) directly from your DMARCify dashboard in real time with zero further DNS edits.

Every standard DNS provider in the world supports CNAME delegation. Because CNAME is a core fundamental standard of the internet DNS protocol (RFC 1034), it works directly with Cloudflare, GoDaddy, Namecheap, AWS Route 53, Google Cloud DNS, Microsoft Azure DNS, cPanel, Bind, Squarespace, and Wix.

Yes, completely. The CNAME record is published strictly on your _dmarc host prefix. It delegates only your DMARC policy query, granting zero access to your primary domain, root nameservers, web hosting, email inbox contents, or MX mail routing.

Yes. If your organisation has an internal compliance rule preventing CNAME records on email subdomains, you can select the Manual Direct TXT tab in your domain settings. This generates a complete static TXT string that you can paste directly into your registrar.

Domain verification confirms that you hold authentic administrative authority over every domain added to your workspace. This prevents third parties from registering domains they do not own and ensures clean, isolated ingestion of your aggregate security reports.

DMARCify checks your public authoritative DNS records in real time using a flexible hybrid model. Your domain verifies immediately if any of the following conditions are met:

• Managed CNAME Delegation: Your _dmarc record points to your assigned endpoint on dmarcify.top.
• Live DMARC Record: Your live DMARC TXT record contains your private ingestion address (for example rua=mailto:ingest+token@dmarcify.top).
• Ownership Challenge TXT: You have published a lightweight TXT record on _dmarcify-challenge.yourdomain.com containing dmarcify-verify={token}.

If you have already published your DMARC record, you do not need to create any extra challenge records. Clicking "Verify DNS Records" will detect your record and verify your domain automatically.

We enforce a 48-hour transient grace window. If a scheduled background check encounters a temporary nameserver outage or resolver timeout, your domain enters a soft warning state rather than having its verification revoked immediately. Ingestion continues uninterrupted throughout the grace window.

Always begin at p=none. Review your DMARCify Sending Sources report to confirm that all legitimate third-party services sending email on your behalf (such as Google Workspace, Microsoft 365, SendGrid, Mailchimp, or Zendesk) pass SPF and DKIM alignment.

Once your alignment score reaches 99% or higher, switch to p=quarantine with a partial percentage (for example pct=25). Monitor the reports for 7 to 14 days, scale to pct=100, and finally advance to p=reject.

No. Standard DMARC aggregate reports contain zero email body content, zero subject lines, and zero recipient addresses. They provide only aggregated counts, sending server IP addresses, and SPF/DKIM verification results.

Telemetry records are retained based on your workspace plan tier. You can also purge historical telemetry for any individual domain at any time from your Domain DNS settings without losing your ingestion token or configuration.