Should the DMARC record be set for the verified domain or the MAIL FROM domain?

Question

I have a verified domain, which is `example.com`, and I use the MAIL FROM domain `ses.mail.example.com`. However, the information provided in this documentation regarding setting up DMARC record isn't entirely clear when it comes to cases involving a custom MAIL FROM subdomain.
So, my question is whether I should create a TXT record for `_dmarc.ses.mail.example.com`, or if setting up one for `_dmarc.example.com` alone would suffice.

Harvito · Answer

I have the same question, if i alreasy setup the custom mail from should i create 2 dmarc record?
one for example.com and another for the custom mail.example.com?

Jesse_T · Answer

This blog goes into more detail https://aws.amazon.com/blogs/messaging-and-targeting/email-authenctication-dmarc-policy/

SuperGraham · Answer

If you create a DMARC record for the parent domain, you can use sp= to define a DMARC record for subdomains.
If you get the 'MAIL FROM record is not aligned' error in VDM it's because you have strict alignment settings for SPF and DKIM; adkim=s and aspf=s, so change these to relaxed; adkim=r and aspf=r.

Gary Mclean · Answer

Dmarc records are used to confirm the MAIL FROM header. SPF is for the envelope.

So your dmarc record needs to confirm the FROM. 
So if you use subdomains in the from that’s where your dmarc records need to exist.

Should the DMARC record be set for the verified domain or the MAIL FROM domain?

Relevant content