How to Add a DMARC Record in AWS Route 53

If your domain is managed in AWS Route 53, adding a DMARC record is a quick task once you find the hosted zone. This guide walks through adding a DMARC TXT record in the Route 53 console so you can start protecting your domain from spoofing and phishing.

Why You Need DMARC

DMARC tells receiving mail servers what to do when an email claiming to be from your domain fails SPF or DKIM checks. Without a DMARC record, attackers can impersonate your domain to send phishing emails, and you have no visibility into who is sending mail as you.

A DMARC record also unlocks aggregate reports (RUA) so you can see exactly which services send mail on your behalf. If you are not sure whether you already have a record, use the free DMARC record checker below before you start.

Prerequisites

Before adding DMARC, ensure you have:

• A hosted zone in Route 53 for your domain
• AWS console access with Route 53 permissions
• SPF and DKIM already configured (recommended)

If you need a DMARC record generated for you, dmarccreator.com will build one to your specification.

Step 1: Open the Route 53 Console

1. Sign in to the AWS Management Console
2. Search for Route 53 and open the service
3. Click Hosted zones in the left navigation
4. Click your domain name to open the hosted zone

You will see the existing records for your domain listed.

Step 2: Create the DMARC TXT Record

1. Click Create record
2. Leave Simple routing selected and click Next (if prompted)
3. Fill in the fields below

Important notes:

• Enter only _dmarc in the record name; Route 53 appends your domain automatically
• Route 53 requires double quotes around the TXT value
• Replace [email protected] with a real mailbox you can monitor

Click Create Records

Click Create records to save the new TXT record.

Step 3: Verify the Record

DNS in Route 53 propagates quickly, usually within a minute or two. Once it does, confirm the record is live:

Example DMARC Records

Monitoring Only (Start Here)

v=DMARC1; p=none; rua=mailto:[email protected]

Collects reports without affecting email delivery.

Quarantine Policy

v=DMARC1; p=quarantine; rua=mailto:[email protected]

Sends failing email to spam.

Reject Policy

v=DMARC1; p=reject; rua=mailto:[email protected]

Blocks failing email entirely.

Editing an Existing Record

1. Open the hosted zone
2. Select the existing _dmarc TXT record
3. Click Edit record
4. Update the value (keep the quotes)
5. Click Save

Common Mistakes

Forgetting the Quotes

Route 53 will reject the record or store it incorrectly if the value is not wrapped in double quotes.

Entering the Full Domain

If you type _dmarc.yourdomain.com as the record name, Route 53 creates _dmarc.yourdomain.com.yourdomain.com. Use only _dmarc.

Creating Multiple DMARC Records

Only one DMARC TXT record is allowed per domain. Multiple records cause receivers to ignore DMARC entirely. Delete any duplicates before saving a new one.

Wrong Record Type

DMARC must be a TXT record, not CNAME or SPF. Double-check the type dropdown.

What To Do After Publishing

Publishing p=none is only the beginning. The goal is to move to an enforcing policy (p=quarantine or p=reject) once you have confirmed every legitimate sender is authenticating.

1. Collect reports for 2-4 weeks using p=none
2. Fix any senders that fail SPF or DKIM alignment
3. Move to p=quarantine for a few weeks
4. Advance to p=reject once you are confident

For ongoing visibility, deliverabilitychecker.com will monitor your SPF, DKIM, DMARC, and MX records daily and alert you when something changes.

Complete Checklist

• [ ] Opened the Route 53 hosted zone
• [ ] Created a TXT record named _dmarc
• [ ] Wrapped the value in double quotes
• [ ] Used a valid reporting mailbox
• [ ] Saved and verified with the DMARC checker
• [ ] Planned the path to enforcement

Monitor Your DMARC Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.