A DMARC record is a single TXT record, which makes it look trivial and makes the failures hard to spot. On Gandi in particular, most broken setups are not policy mistakes — they are records that were saved with the wrong hostname, double-quoted values or an unescaped semicolon. This guide covers the mechanics and the traps.
Publish the record in Gandi's DNS editor
- In the Gandi admin, open the domain and go to the DNS Records tab.
- Add a record of type TXT. In the name field enter
_dmarc only — Gandi appends the domain automatically. Entering the full _dmarc.example.com creates _dmarc.example.com.example.com, which no receiver will ever query.
- In the value field enter the policy without surrounding quotes:
v=DMARC1; p=none; rua=mailto:dmarc@example.com. Gandi handles quoting on save. Pasting a quoted string makes the quotes part of the value, and the record is then syntactically invalid.
- Leave TTL at the default unless you are actively testing. A long TTL means a correction takes hours to become visible.
- Save, then verify from outside Gandi rather than trusting the panel.
Confirm what is actually published
Query _dmarc.yourdomain.com with the TXT Lookup and check three things: exactly one TXT record is returned, it begins with v=DMARC1, and the reporting address is intact. Then open the DMARC checker for a parsed view of the policy tags.
If nothing resolves, the usual causes are the duplicated hostname described above, a record saved in a different zone than the one serving the domain, or a stale negative cache entry.
Get SPF and DKIM in place first
DMARC evaluates alignment, so it has nothing to align to unless SPF or DKIM is already working. Gandi Mail publishes its own SPF include in the mailbox settings — use that value rather than copying one from a tutorial, because the correct include depends on which Gandi mail offer the domain uses.
Verify SPF with the SPF Checker and the DKIM selector with the DKIM Checker. A DMARC record published on top of broken authentication produces a steady stream of failures and no useful protection.
Phase the policy
Start at p=none with rua= reporting, and keep it there until you have seen every sender your domain uses. Small domains often discover a website contact form, an invoicing tool or an old hosting account still sending as the domain.
p=none — collect reports, identify sources, change nothing else.p=quarantine; pct=25 — quarantine a quarter of failing mail, watch the reports for volume you did not expect.p=quarantine full — only when every failing source is one you have deliberately excluded.p=reject — the end state, once false positives are no longer possible.
Read the daily XML with the DMARC Report Analyzer at each step. Reports are the only evidence that a policy change did what you intended.
FAQ
Does Gandi support DMARC in its own mail service?
Gandi Mail can publish the records, but DMARC is evaluated by the receiving provider, not by Gandi. The record works for any mail flowing from your domain, wherever it is sent from.
Can I use a different reporting address?
Yes. Use an address you actually monitor. A rua mailbox that nobody reads produces the same result as publishing no policy at all.
Why does the record show as two strings?
Long TXT values are commonly split into quoted segments by DNS tooling. That is valid as long as the segments concatenate into one policy. A checker that fails on a split record is a checker bug, not a DNS problem.
