Complete SPF record setup guide, including syntax explanation and best practices
Configure DANE for SMTP with TLSA records to enforce secure delivery
Set up MTA-STS policy with Cloudflare for secure SMTP delivery
A DMARC record is a single TXT record, which makes it look trivial and makes the failures hard to spot. On Gandi in particular, most broken setups are not policy mistakes — they are records that were saved with the wrong hostname, double-quoted values or an unescaped semicolon. This guide covers the mechanics and the traps.
_dmarc only — Gandi appends the domain automatically. Entering the full _dmarc.example.com creates _dmarc.example.com.example.com, which no receiver will ever query.v=DMARC1; p=none; rua=mailto:dmarc@example.com. Gandi handles quoting on save. Pasting a quoted string makes the quotes part of the value, and the record is then syntactically invalid.Query _dmarc.yourdomain.com with the TXT Lookup and check three things: exactly one TXT record is returned, it begins with v=DMARC1, and the reporting address is intact. Then open the DMARC checker for a parsed view of the policy tags.
If nothing resolves, the usual causes are the duplicated hostname described above, a record saved in a different zone than the one serving the domain, or a stale negative cache entry.
DMARC evaluates alignment, so it has nothing to align to unless SPF or DKIM is already working. Gandi Mail publishes its own SPF include in the mailbox settings — use that value rather than copying one from a tutorial, because the correct include depends on which Gandi mail offer the domain uses.
Verify SPF with the SPF Checker and the DKIM selector with the DKIM Checker. A DMARC record published on top of broken authentication produces a steady stream of failures and no useful protection.
Start at p=none with rua= reporting, and keep it there until you have seen every sender your domain uses. Small domains often discover a website contact form, an invoicing tool or an old hosting account still sending as the domain.
p=none — collect reports, identify sources, change nothing else.p=quarantine; pct=25 — quarantine a quarter of failing mail, watch the reports for volume you did not expect.p=quarantine full — only when every failing source is one you have deliberately excluded.p=reject — the end state, once false positives are no longer possible.Read the daily XML with the DMARC Report Analyzer at each step. Reports are the only evidence that a policy change did what you intended.
Gandi Mail can publish the records, but DMARC is evaluated by the receiving provider, not by Gandi. The record works for any mail flowing from your domain, wherever it is sent from.
Yes. Use an address you actually monitor. A rua mailbox that nobody reads produces the same result as publishing no policy at all.
Long TXT values are commonly split into quoted segments by DNS tooling. That is valid as long as the segments concatenate into one policy. A checker that fails on a split record is a checker bug, not a DNS problem.