On this page

Fixing DMARC in AWS Route 53

What this fixes

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM, and lets you receive reports about spoofing attempts against your domain. See Fixing DMARC Record Issues for what each tag means — this guide covers the Route 53-specific steps. Make sure SPF and DKIM are already set up first.

This assumes you already have a hosted zone in Route 53 for your domain, and IAM permissions to edit it.

How to fix it

  1. Open the Route 53 console and go to Hosted zones → select your domain's hosted zone.
  2. Click Create record.
  3. Record name: _dmarc
  4. Set Record type to TXT.
  5. Under Value, enter the record content in quotes, e.g. "v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1" — Route 53 requires TXT values to be wrapped in double quotes.
  6. Leave TTL at the default (300s is fine).
  7. Click Create records.
  8. Re-run your scan to confirm.

If a _dmarc TXT record already exists, edit it rather than creating a second one.

Common pitfalls

  • Forgetting to wrap the TXT value in double quotes — Route 53 will otherwise reject or mis-parse the record.
  • Setting p=reject before verifying all legitimate senders pass SPF/DKIM — start with p=none while reviewing reports, then tighten gradually.