How to add a DMARC record on Amazon Route 53
DMARC tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM checks — and sends you reports about who is sending as your domain. Without it, authentication results are advisory and you fly blind.
The record is a TXT record at the _dmarc subdomain of your domain. Start with p=none (monitoring only — nothing about delivery changes), read the reports, then tighten to p=quarantine and finally p=reject.
The record you'll add
TypeTXT
Record name_dmarcEnter just _dmarc — Amazon Route 53 appends your domain automatically.
Value"v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"Point rua at a mailbox you actually read (an address on your own domain works without extra setup). If you send reports to a different domain, that domain's owner must publish an authorization record — most DMARC report services handle this for you.
TTL300 seconds is a good value; Route 53 changes reach its nameservers within about 60 seconds.
Steps on Amazon Route 53
- Open the Route 53 console (console.aws.amazon.com/route53/) and go to Hosted zones.
- Select your domain's hosted zone and click Create record.
- Leave Record name blank for the root domain, or enter just the prefix (like _dmarc).
- Pick the record type, paste the value — TXT values wrapped in double quotes — and create the record.
Amazon Route 53 quirks worth knowing
- ⚠TXT values must be enclosed in double quotes: "v=spf1 …". Values longer than 255 characters are split into multiple quoted strings on one line.
- ⚠Route 53 still offers a legacy record type named SPF — don't use it; AWS itself recommends TXT only.
Provider steps verified against AWS: Creating records in Route 53 on 2026-07-12.
Get the exact record for your domain
The free DMARC checker reads your domain's live DNS, flags what's wrong, and generates the precise DMARC record to publish — then rechecks to confirm the fix took.
Run the DMARC checker →Frequently asked questions
- What goes in the Record name field on Amazon Route 53?
- Enter just _dmarc — Amazon Route 53 appends your domain automatically, so don't type the full _dmarc.yourdomain.com.
- How long until the record is live?
- 300 seconds is a good value; Route 53 changes reach its nameservers within about 60 seconds. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- Which DMARC policy should I start with?
- p=none. It changes nothing about mail delivery but turns on aggregate reporting, so you can see every source sending as your domain. Move to p=quarantine once the reports show all your legitimate senders passing, and to p=reject when quarantine has run clean for a few weeks.