Getting started with DMARCdrift

DMARCdrift monitors your domain's DMARC aggregate reports and surfaces what matters: alignment problems, unknown senders, spoofing signals. Setup takes about five minutes. The bulk of the work is a one-line DNS change.

1. Create an account

Sign up at dmarcdrift.com. You can sign in with GitHub, Google, or email and password.

2. Add your first domain

After signing in, add the domain you want to monitor. Enter the bare domain (yourdomain.com, not www.yourdomain.com).

DMARCdrift will assign a unique inbound address for that domain. It looks like:

d-abc123@in.dmarcdrift.com

This is the address you'll add to your DMARC record's rua= tag. Each domain gets its own address so reports are routed correctly.

3. Update your DMARC record

Add your assigned inbound address to your domain's DMARC record.

Automatic setup (Cloudflare, GoDaddy, IONOS)

If your domain uses Cloudflare, GoDaddy, or IONOS, DMARCdrift can write the DNS record for you. After adding your domain, look for the Set up DNS automatically card on the domain page. Clicking it takes you to your DNS provider where you approve the change in one click — no copy-pasting required.

Manual setup

If you don't have a DMARC record yet, create one at _dmarc.yourdomain.com:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:d-abc123@in.dmarcdrift.com"

If you already have a DMARC record, add the DMARCdrift address to your existing rua= tag without removing any current destinations:

rua=mailto:existing@yourdomain.com,mailto:d-abc123@in.dmarcdrift.com

Receivers send reports to every address listed in rua=, so adding DMARCdrift doesn't affect your existing report delivery.

Use the DMARC record generator if you want help constructing the record, or the DMARC checker to verify your record looks correct after publishing.

4. Wait for reports to arrive

DNS changes propagate within minutes to a few hours. DMARC aggregate reports are sent by receivers (Google, Microsoft, Yahoo, and others) once per day, typically for the previous 24-hour period.

In practice: expect your first reports within 24-48 hours of publishing the updated DNS record, assuming your domain is sending email.

If no reports arrive after 48 hours, see troubleshooting setup.

5. Confirm setup is working

Once reports start arriving, DMARCdrift will show:

• Your alignment rate across all reporters
• Which sources are sending mail on behalf of your domain
• Whether each source is passing DMARC alignment

A healthy first look shows your primary mail provider (Google Workspace, Microsoft 365, or your transactional ESP) passing at high alignment. Anything unrecognized in the sources list is worth investigating before you move to enforcement.

What "no reports yet" means

If you're logged in and see no data, one of three things is true:

1. DNS hasn't propagated yet. Wait a few more hours and check again.
2. Your domain isn't sending email. Receivers only send reports for domains they've actually seen mail from. A domain with no outbound activity won't appear in anyone's reports.
3. Your rua= address is wrong. Double-check the address in your DNS record matches exactly what DMARCdrift shows in your domain settings.

You can verify your record is published correctly with the DMARC check tool.

Next: Add DMARCdrift to your DMARC record: detailed examples for every DNS configuration scenario.