Add a DMARC record at netcup

The starting value

With p=none nothing changes for delivery, you only receive reports. That is the right start because the reports show which services send on behalf of the domain and whether SPF and DKIM match for them. The rua address should be a mailbox someone reads, or a report service.

v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com

Afterwards: quarantine and reject

After four to eight weeks of reports and fixed SPF and DKIM records, edit the record at netcup to p=quarantine, with pct=25 if you like, and finally p=reject. The record is only edited, never recreated.

v=DMARC1; p=reject; rua=mailto:dmarc@your-domain.com; adkim=s; aspf=s

How to add the DMARC record at netcup

The way to the netcup DNS editor:

• In the netcup Customer Control Panel (CCP) open "Domains" and select the domain.
• Switch to the "DNS" tab and choose "Add new record".
• Type TXT, host name _dmarc (at some hosts _dmarc.your-domain.com), value: the DMARC record starting with v=DMARC1.
• Enter host (@ for the apex), type and destination, then "Save DNS records".

Typical mistakes at netcup

• Wrong name: the record sits on the domain instead of _dmarc.
• Domain doubled in the name (_dmarc.your-domain.com.your-domain.com) because the host appends the domain itself.
• rua without mailto: or with a typo, then no reports arrive.
• p=none stays forever and protects nothing.

Verify and keep an eye on it

After saving, the change at netcup usually applies within minutes. The checker below queries the authoritative name servers and shows right away whether the DMARC record is read correctly. DomainWarn keeps checking the record afterwards and alerts you when it changes or disappears, for example after a migration or one click too many in the DNS editor.

Frequently asked questions

Do I enter _dmarc or _dmarc.your-domain.com at netcup?

It depends on the editor: if netcup appends the domain automatically, enter just _dmarc. The result must be _dmarc.your-domain.com; the DMARC checker shows whether it is right.

Can I set DMARC without DKIM?

Yes, with p=none for monitoring. For quarantine or reject DKIM should be in place because SPF breaks on forwarding.