Email Authentication – DMARC

Overview

Email authentication is critical to ensuring your PXME emails land in inboxes instead of spam. A key part of this process is DMARC (Domain-based Message Authentication, Reporting, and Conformance).

DMARC validates whether the domain in your From Address matches the actual domain used to send your email. If they don’t align, your emails may fail DMARC checks and risk being rejected or flagged as spam.

What is DMARC?

DMARC works alongside SPF and DKIM to validate your email messages. It tells receiving servers how to handle emails that fail authentication:

• p=none → Monitor only (emails delivered, even if they fail).

• p=quarantine → Emails may be delivered to spam/junk.

• p=reject → Emails are rejected outright.

Why it matters:

• Protects your brand from spoofing/phishing.

• Improves deliverability when configured correctly.

DMARC in PXME

PXME uses two types of sending domains:

1. Shared Sending Domain

• Emails sent through PXME’s shared domains: mg.msgsndr.net and mg.msgsndr.org.

• DMARC is not required for shared domains.

• However, if your From Address domain enforces a strict DMARC policy (p=reject or p=quarantine), messages may bounce.

Error Example:
“The domain in your From Address (kate@test.com) has a p=reject DMARC policy. Most inbox providers will reject your messages without a dedicated sending domain.”

Temporary Fix:

• Change DMARC policy in DNS to p=none.

• Note: This weakens security and should only be temporary.

2. Dedicated Sending Domain

• To be fully DMARC compliant, connect a dedicated sending domain to PXME.

• It must match your From Address domain.

  • Example: Sending as kate@test.com → dedicated sending domain should be mg.test.com.

• This alignment ensures messages pass DMARC and prevents bounces.

How to Fix DMARC Failures

If Using Shared Domains

• Failures may occur if your domain enforces p=reject.

• Temporary fix: Set DMARC to p=none in DNS.

If Using Your Own Domain

• Set up a dedicated sending domain (e.g., mg.yourdomain.com).

• Ensure SPF, DKIM, and DMARC are all correctly configured in DNS.

• This creates full alignment and prevents rejections.

Pro Tips

• Always use a dedicated sending domain for long-term reliability.

• Monitor DMARC reports regularly to spot authentication issues early.

• Adjust gradually – start with p=none, then tighten to quarantine or reject once stable.

• Work with your DNS provider to ensure SPF, DKIM, and DMARC are set correctly.

FAQs

Q1: What is DMARC and why is it important?
It’s an authentication protocol that prevents spoofing and ensures emails align with SPF/DKIM, improving both security and deliverability.

Q2: What should I do if my PXME emails are failing DMARC checks?
Set DMARC to p=none temporarily, then configure a dedicated sending domain for permanent resolution.

Q3: How do I fix the p=reject DMARC error?
Change your DNS DMARC record from p=reject to p=none, then set up a dedicated sending domain.

Q4: How do I set up a dedicated sending domain?
Work with your DNS provider to create a subdomain (e.g., mg.yourdomain.com) and configure it for PXME. Ensure it matches your From Address.

Q5: Where can I find more info on DMARC setup?
Check PXME documentation or external technical resources like “How to Set Up DMARC Records for Email.”