Skip to main content
dmarc PROTOCOLHost: AWS Route 53Standard: RFC 7489

How to Configure Domain-based Message Authentication, Reporting, and Conformance (DMARC) on AWS Route 53

Enforces receiver policy (none, quarantine, reject) when SPF and/or DKIM alignment fails, and generates forensic aggregate reports. Follow this verified implementation guide to deploy standard compliant DMARC DNS records in AWS Route 53.

Default DMARC Record Syntax

// Authoritative RFC Example
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com; pct=100; aspf=r; adkim=r

Configuration Steps in AWS Route 53

  1. 1Open the AWS Management Console and navigate to Route 53.
  2. 2Select "Hosted zones" and click on your domain zone.
  3. 3Filter records by the target subdomain name.
  4. 4Select the checkbox next to the orphaned record.
  5. 5Click "Delete record" and confirm the deletion dialog.

Verification Checklist (RFC 7489)

Query DNS TXT record at _dmarc.yourcompany.com.
Ensure valid "p=" policy exists (transition from p=none to p=quarantine to p=reject).
Verify "rua=" tag points to an authenticated inbox or monitoring service.
Check alignment modes (aspf and adkim default to relaxed "r").
Live Validation Engine

Validate Your AWS Route 53 DMARC Record

Verify propagation, check syntax formatting, and audit recursive lookups in 60 seconds with SubDomainWatch.

Run Free DNS Validator