dmarc PROTOCOLHost: Azure DNSStandard: RFC 7489
How to Configure Domain-based Message Authentication, Reporting, and Conformance (DMARC) on Azure DNS
Enforces receiver policy (none, quarantine, reject) when SPF and/or DKIM alignment fails, and generates forensic aggregate reports. Follow this verified implementation guide to deploy standard compliant DMARC DNS records in Azure DNS.
Default DMARC Record Syntax
// Authoritative RFC Example
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com; pct=100; aspf=r; adkim=rConfiguration Steps in Azure DNS
- 1Navigate to the Azure Portal and select "DNS zones".
- 2Select your authoritative domain zone.
- 3Find the record set corresponding to the dangling subdomain.
- 4Click "Delete" from the top command toolbar.
- 5Confirm deletion to release the DNS binding.
Verification Checklist (RFC 7489)
Query DNS TXT record at _dmarc.yourcompany.com.
Ensure valid "p=" policy exists (transition from p=none to p=quarantine to p=reject).
Verify "rua=" tag points to an authenticated inbox or monitoring service.
Check alignment modes (aspf and adkim default to relaxed "r").
Live Validation Engine
Run Free DNS ValidatorValidate Your Azure DNS DMARC Record
Verify propagation, check syntax formatting, and audit recursive lookups in 60 seconds with SubDomainWatch.