Defaults.Exposed

Defaults.Exposed › Setup walkthroughs › DMARC › Timeweb

How to set up DMARC on Timeweb

Open the DNS (Domain Name System) editor and look at the existing rows before adding anything. Timeweb’s own documentation says a DMARC (Domain-based Message Authentication, Reporting and Conformance) record is applied automatically for a delegated domain using Timeweb Mail, so a _dmarc row can already be sitting there before you arrive. Two DMARC records at the same name are treated as no valid record at all, so edit an existing row instead of adding another.

The DMARC record for Timeweb

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

v=DMARC1 names the version and has to come first. p=none is the policy, asking receivers to change nothing. rua=mailto: is where aggregate reports arrive.

If a record is already there, read its p= value before you change anything, and read whether it carries a rua= address at all. A policy with no reporting address collects nothing, which is the state 35,049,364 domains at p=none are in according to the October 2026 census, 80.17% of that group.

Check that Timeweb answers DNS for the domain

The Timeweb DNS editor only affects a domain that is delegated to Timeweb’s own nameservers. Open the domain’s row in «Домены и SSL» (Domains and SSL) and check the nameservers listed there against what the registrar shows. If the nameservers point at a different host, a CDN (Content Delivery Network) or the email provider instead, the record has to go in wherever that other provider answers DNS, because the Timeweb editor will save the entry and still do nothing.

Timeweb is the DNS host and, for Timeweb Mail customers, the mail provider too, in both its classic panel and the Timeweb Cloud panel. For a delegated domain using Timeweb Mail, Timeweb can publish a _dmarc record on its own without you adding one. For every other domain, Timeweb publishes only the exact TXT (Text) record you type into the DNS editor and save.

Add or edit the record in the Timeweb console

  1. Sign in to Timeweb and open «Домены и SSL» (Domains and SSL), then «Мои домены» (My domains). In the Timeweb Cloud panel, open «Домены и SSL» and then the domain’s own DNS tab instead.
  2. Click the row for the domain in question to open its settings.
  3. Open the «Редактор DNS» (DNS editor) tab for that domain.
  4. Check the existing rows first for a record already named _dmarc, since Timeweb Mail can add one automatically on a delegated domain.
  5. If a _dmarc record already exists, open that row to edit it rather than clicking «Добавить запись» (Add record) again.
  6. If none exists, click «Добавить запись» (Add record) to start a new row.
  7. Set the record type field to TXT.
  8. In the «Хост» (Host) field, enter exactly _dmarc, since Timeweb appends the domain name for you.
  9. In the «Значение» (Value) field, paste the record value with no surrounding quote marks, leave TTL (Time to Live) at the panel default, and save.

The «Хост» (Host) field takes only _dmarc, since Timeweb appends the domain name itself, so typing _dmarc.yourdomain.com in full duplicates the domain and typing dmarc without the leading _ character names the wrong record. The «Значение» (Value) field takes the plain string starting v=DMARC1; with the mailbox after rua=mailto: replaced by an address you read, and with no quote marks added around it.

Traps in the Timeweb form

When mail leaves through more than Timeweb

The common case for a domain here is mixed sending: Timeweb Mail or the Timeweb-hosted site on one side, and Google Workspace, Microsoft 365 or a mailing tool on the other. DMARC is where that mix shows up, because the reports arrive covering all of it.

What DMARC asks of each sender is the same. Either SPF passes for a domain that matches your From address, or a DKIM signature verifies against a key published on your domain. One is enough, and the matching part is the half that surprises people: a platform can pass SPF (Sender Policy Framework) on its own domain and still fail DMARC on yours, because the domain that authenticated is not the domain in the visible From address.

DKIM (DomainKeys Identified Mail) is the more durable of the two, because a signature survives forwarding and an SPF pass does not. A message forwarded from one mailbox to another arrives at the second receiver from a server that was never on your SPF list, so SPF fails and only the signature can carry it.

For a mixed setup, the practical order is to get each sender signing with DKIM on your domain where the platform supports it, add SPF includes where it does not, and leave the policy at p=none until the reports show every one of them clean.

The policy ladder

p= takes three values and each is a different instruction to a receiver. none changes nothing and asks for reports. quarantine asks receivers to treat failing mail as suspicious, which usually means it lands in spam. reject asks them to refuse it outright, so it reaches no folder at all.

pct= is what turns the climb into steps. v=DMARC1; p=quarantine; pct=10; rua=mailto:you@yourdomain.com applies the policy to a tenth of failing messages while the rest are handled as before. A sender you overlooked costs a tenth of the damage, appears in the reports, and gets fixed before you raise the figure. Work it up over a few weeks, then drop the tag and move to reject.

Two more tags exist for situations you may not have. sp= sets a separate policy for subdomains, which matters when a service sends from one and the parent policy is already strict. adkim= and aspf= decide whether alignment is relaxed, the default, or strict; relaxed is nearly always right because it lets a subdomain satisfy the parent.

If the record in your zone was created automatically by Timeweb rather than by you, check which of these it carries before assuming the domain is where you want it.

Wait, then read the result

The change is not instant, so re-check it after a while. The saved record appears as a row in the same «Редактор DNS» (DNS editor) tab where it was entered.

How the scan grades this record: the DMARC policy check, with its pass and fail rules and how many domains pass it.

Run the free scan on this site to confirm the record is published and to see which policy it currently carries, which is also how you find out what an automatically created record was set to.

Once every sender in the reports is passing and aligned, raise the policy to p=quarantine, and then to p=reject. Receivers act on the record only at p=quarantine or p=reject.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.