Skip to main content
dmarc PROTOCOLHost: BIND / Named RFC Zone FileStandard: RFC 7489

How to Configure Domain-based Message Authentication, Reporting, and Conformance (DMARC) on BIND / Named RFC Zone File

Enforces receiver policy (none, quarantine, reject) when SPF and/or DKIM alignment fails, and generates forensic aggregate reports. Follow this verified implementation guide to deploy standard compliant DMARC DNS records in BIND / Named RFC Zone File.

Default DMARC Record Syntax

// Authoritative RFC Example
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.com; pct=100; aspf=r; adkim=r

Configuration Steps in BIND / Named RFC Zone File

  1. 1Open the authoritative BIND zone file on your nameserver (/etc/bind/zones/db.domain).
  2. 2Locate the orphaned CNAME or NS entry.
  3. 3Comment out or delete the entire resource record line.
  4. 4Increment the SOA serial number (YYYYMMDDNN format).
  5. 5Execute `named-checkzone` to validate syntax and reload with `rndc reload`.

Verification Checklist (RFC 7489)

Query DNS TXT record at _dmarc.yourcompany.com.
Ensure valid "p=" policy exists (transition from p=none to p=quarantine to p=reject).
Verify "rua=" tag points to an authenticated inbox or monitoring service.
Check alignment modes (aspf and adkim default to relaxed "r").
Live Validation Engine

Validate Your BIND / Named RFC Zone File DMARC Record

Verify propagation, check syntax formatting, and audit recursive lookups in 60 seconds with SubDomainWatch.

Run Free DNS Validator