Plesk Obsidian: Creating and Managing DMARC Records

Configuring a plesk dmarc record is essential for protecting your domain against email spoofing, phishing, and domain impersonation while ensuring your legitimate emails reach the inbox. DMARC (Domain-based Message Authentication, Reporting, and Conformance) relies on SPF and DKIM to verify outgoing mail and tells receiving servers how to handle messages that fail authentication. You can easily diagnose and validate your setup using the DMARC Checker on XiaTools to instantly verify your DNS configuration and catch syntax errors before they impact your email delivery.

Prerequisites for Plesk DMARC Setup

Before you add a DMARC record to your Plesk Obsidian server, you must ensure your domain has functional Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records in place. DMARC evaluates whether an incoming email's "From" header aligns with the domains validated by SPF and DKIM.

1. Verify SPF and DKIM

Log in to your Plesk panel, navigate to Mail > Mail Settings, and select your domain name. Ensure that Use DKIM spam protection system is checked and active. Next, check your DNS settings to confirm your SPF record exists. A standard SPF record for example.com typically looks like this:

example.com. IN TXT "v=spf1 mx a ip4:192.0.2.1 ~all"

If SPF or DKIM are missing or improperly configured, a strict DMARC policy will cause all your outbound mail to be rejected or sent straight to the spam folder. Always verify these foundational layers first.

How to Create a Plesk DMARC Record

Plesk Obsidian simplifies DNS management by providing built-in tools to generate and publish standard TXT records without needing to write raw DNS zone files manually.

Step-by-Step DNS Template Configuration

1. Log in to your Plesk Obsidian administrative dashboard.
2. In the left-hand navigation sidebar, click on Domains and select the domain name you want to secure (e.g., example.com).
3. Locate the Dev Tools or DNS Settings card on the domain dashboard and click DNS Settings.
4. Click the Add Record button at the top of the DNS zone editor.
5. Set the record type dropdown to TXT.
6. In the Domain name or Record name field, enter _dmarc (or _dmarc.example.com. depending on your Plesk version; Plesk will automatically append your domain name).
7. In the TXT record or Value field, paste your tailored DMARC policy string.
8. Click OK or Update to save the record to your local Plesk DNS zone.

Understanding DMARC Record Syntax

A robust initial plesk dmarc record utilizes a monitoring policy (p=none) so you can review authentication reports without risking legitimate email delivery. Here is an example of a production-ready baseline record:

v=DMARC1; p=none; sp=none; rua=mailto:dmarc-reports@example.com; pct=100;

Managing and Upgrading Your DMARC Policy

Once your monitoring period runs for two to four weeks and you have confirmed that all legitimate mail sources (like webforms, transactional servers, and third-party email service providers) pass SPF and DKIM alignment, you should upgrade your policy to quarantine or reject.

Moving from Monitoring to Quarantine

A quarantine policy tells receiving mail servers to place unauthenticated emails into the spam or junk folder rather than delivering them to the primary inbox. Update your TXT record value in Plesk DNS Settings to:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com;

Moving to Strict Enforcement (Reject)

The ultimate goal of DMARC is full rejection of unauthenticated spoofed mail. When p=reject is active, receiving mail servers drop the fraudulent email entirely at the SMTP level before delivery occurs:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com;

Verifying Your Record Using Command Line Tools

After adding or updating your record in Plesk, use command-line utilities to ensure the DNS propagation is complete and the syntax is recognized globally.

Using dig on Linux and macOS

Run the following dig command to query the TXT record for your DMARC subdomain:

dig TXT _dmarc.example.com +short

Sample expected output:

"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;"

Using PowerShell on Windows

If you are managing your domain from a Windows workstation, run this cmdlet in PowerShell:

Resolve-DnsName -Name _dmarc.example.com -Type TXT

Sample expected output:

Name             Type TTL   Section    String
----             ---- ---   -------    ------
_dmarc.example.com TXT  3600  Answer     v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;

Common Mistakes and How to Fix Them

Even experienced administrators occasionally run into syntax or deployment issues when configuring DMARC in Plesk.

• Incorrect Hostname Entry: Entering example.com instead of _dmarc as the record name results in a broken DMARC record that mailbox providers ignore. Always ensure the prefix is strictly _dmarc.
• Skipping SPF/DKIM Alignment: Implementing p=reject immediately without checking DKIM selectors or third-party sending IPs will instantly block your own legitimate business emails. Always start with p=none.
• Invalid Email URIs: Forgetting the mailto: prefix inside the rua= or ruf= tags causes receiving servers to discard the reporting instruction. Ensure it reads mailto:admin@example.com.
• Conflicting Multiple Records: Creating more than one DMARC record for the same domain violates RFC specifications and causes receiving mail servers to ignore DMARC entirely. Merge all tags into a single TXT record.

DMARC Implementation Checklist

• Confirm SPF and DKIM are fully active and passing on your Plesk server.
• Create an administrative email address to receive XML aggregate reports.
• Add the _dmarc TXT record with p=none inside Plesk DNS Settings.
• Verify DNS propagation using command-line tools or online diagnostics.
• Monitor DMARC aggregate reports for at least two weeks.
• Upgrade the policy tag from p=none to p=quarantine, and eventually to p=reject.