How to set up DMARC on Beget

Add a DMARC record in Beget to tell mail providers what to do with email that fails your checks.

Why this matters to your business

DMARC ties SPF and DKIM together and adds the missing instruction: what should a receiving mail provider do when an email claiming to be from you fails the checks? Without DMARC, each provider guesses. With it, you decide — and you can ask them to send you reports showing who is sending mail in your name.

In plain terms: DMARC is what actually stops criminals from spoofing your domain to scam your customers or staff. It’s the policy on top of the locks SPF and DKIM provide — free, and well worth the few minutes.

Set up SPF and DKIM first

DMARC works by checking the results of SPF and DKIM. If you haven’t added those yet, do them first — a DMARC policy with nothing underneath it has nothing to enforce.

Confirm Beget runs your DNS

This record only works if Beget is answering DNS for your domain — that is, your domain’s nameservers point to Beget’s nameservers (the default for domains registered or hosted at Beget). If they point to another company, add the DMARC record at whichever provider runs your DNS instead.

Step-by-step on Beget

DMARC lives on the host _dmarc.yourdomain.com, which in Beget is a subzone you create first. Labels below are the Russian originals with English equivalents; confirm exact wording in your console.

Sign in to the Beget control panel and open the DNS section.
Select your domain in the list at the top.
Click «Добавить подзону» (Add subzone) and create a subzone named exactly: _dmarc Enter only _dmarc — Beget appends your domain automatically.
Select the new _dmarc subzone, then click «Открыть режим редактирования» (Open editing mode).
In the «Быстрое добавление» (Quick add) block, set the record type to TXT.
Paste a monitoring-only policy into the data field: v=DMARC1; p=none; rua=mailto:[email protected] Replace the address with a mailbox you actually read. This asks providers to email you summary reports without changing how any mail is treated yet.
Save the record.

Choosing your policy (the `p=` part)

p=none — monitor only. Nothing is blocked; you just receive reports. Start here.
p=quarantine — send failing mail to spam/junk.
p=reject — refuse failing mail outright (the strongest protection).

Run p=none for a few weeks, read the reports to confirm all your legitimate mail passes, then move up to quarantine and finally reject. Jumping straight to reject before you’ve checked the reports risks blocking your own genuine email.

Beget quirks people get wrong

_dmarc is a subzone, with the underscore. In Beget you create the _dmarc subzone first and attach the TXT record to it. Leaving off the underscore, or typing _dmarc.yourdomain.com in full, breaks the record.
Don’t add your own quotes. Paste the plain value beginning v=DMARC1; — manual " marks can corrupt it.
One DMARC record only. Like SPF, there must be a single DMARC TXT record. If one exists on the _dmarc subzone, edit it rather than adding a second.
Use a real reporting mailbox. The address after rua=mailto: should be one you genuinely check, or the reports are wasted.
Check the nameservers first. Beget’s editor will happily save the record, but it does nothing if your domain’s nameservers point elsewhere.
Give it time. DNS changes can take a few minutes up to a couple of hours to take effect.

Verify it worked

Once saved and propagated, run the free check on this site. It will tell you in plain language whether your DMARC record is in place and what policy you’ve set.

See the full fix guide →

Done? Check your domain free to confirm it worked — and see your full grade across all 34 checks.