Updating Your DMARC Policy in the OnDMARC Account

This guide explains how to configure your DMARC policy settings within OnDMARC’s Dynamic DMARC feature before delegating the protocol. Following this process ensures your security posture is fully defined and ready to be served the moment the delegation goes live.

Overview of Dynamic DMARC

Redsift’s OnDMARC Dynamic Services replaces traditional, manual DNS text strings with "Smart Records." Instead of editing complex code in your DNS zone file, you manage your policy, including enforcement levels and reporting addresses, through a centralized interface. By delegating the _dmarc subdomain to OnDMARC, updates to your policy take effect in minutes rather than hours.

Step 1: Pre-Configure Your DMARC Policy

Before delegating the protocol in your DNS, it is recommended to "prime" the platform by defining your desired DMARC tags. This ensures that your policy is active the instant the delegation is recognized.

1. Log in to your OnDMARC dashboard and go to the DMARC > Dynamic Services.

2. If it is not already enabled, select CONFIGURE DYNAMIC SERVICES to toggle the feature and enable it in the backend.

3. Select the DMARC tab.

4. Define your Core Policy Settings by populating the following fields:

   • Policy (p): Select your enforcement level (None, Quarantine, or Reject).

   • Percentage (pct): Set the percentage of mail to which the policy applies (default is 100).

   • Subdomain Policy (sp): Define a specific policy for subdomains or leave it to inherit the main policy.

5. Configure your Reporting Destinations (Email Addresses):

   • Aggregate Reports (rua): Ensure the OnDMARC reporting address is listed to receive XML data.

   • Forensic Reports (ruf): Add your designated address for real-time failure alerts.

6. (Optional) Set Advanced Tags such as Alignment (adkim/aspf) or Reporting Intervals (ri).

7. Click SAVE: This saves the configuration to the platform so it is ready to be served once the delegation is live.

Step 2: Delegate DMARC (DNS Delegation)

Once your policy settings are saved in Dynamic Services, you can safely delegate the _dmarc subdomain. This allows the OnDMARC "Smart Record" to respond to receiver queries on your behalf.

1. In OnDMARC, ensure you are still in the DMARC > Dynamic Services > DMARC tab.

2. Prepare to copy the record name and value (typically an NS or CNAME record) generated by the platform:

3. Go to your DNS Provider (e.g., Cloudflare, GoDaddy):

   • Type: NS (or CNAME as specified by the panel)

   • Name: _dmarc or (full version _dmarc.mydomain.com)

   • Value: Paste the smart server address provided by OnDMARC (e.g., ns-dmarc.ondmarc.com).

4. Save the record.

Important Deployment Notes

• Subdomain Delegation: By publishing this record, you are specifically delegating the _dmarc subdomain portion of your DNS to OnDMARC. You are not delegating your entire root domain to the panel.

• Instant Updates: Because you configured your policy in Step 1, the "Smart Record" is already armed. Any future changes to your policy (e.g., moving from Monitoring to Reject) can be done inside OnDMARC and will propagate to the public internet in 5–10 minutes.

• Internal Alignment: When moving to a "Reject" policy, ensure your internal mail servers or security gateways are configured to honor DMARC for inbound mail to avoid internal delivery issues.

• Automated Monitoring: OnDMARC automatically ingests and translates the "noisy" XML reports into a graphical interface, allowing for continuous oversight without manual data parsing.