DMARCER
Sign in

Verifying domain ownership

How to prove you control a domain in DMARCER by publishing a small _DMARCER TXT record, including the step-by-step checks, automatic publishing through a linked DNS provider, and the common things that trip people up.

Published 3 Jul 2026 24

Before DMARCER starts monitoring a domain, it asks you to prove you control it. You do this by publishing one small DNS TXT record that contains a unique code tied to that domain. Until ownership is confirmed the domain stays in your list but is held back: it will not be included in report processing, and the SPF, DMARC, DNSSEC, MTA-STS and TLS-RPT features stay greyed out with a "Validate ownership first" note.

What the ownership record is

When you add a domain, DMARCER creates a unique verification code for it and asks you to publish it as a TXT record. The record always has the same shape:

  • Type: TXT
  • Name (host): _DMARCER.yourdomain.com (the code goes on the _DMARCER label, not on the bare domain)
  • Value: dmarcer-verification= followed by a long unique string, for example dmarcer-verification=ab12cd34...

The code is unique to that one domain and stays the same every time you reload, so you can publish it once and leave it in place. DMARCER checks for the record using a fresh, live DNS lookup, so there is no waiting around on our side once your provider has published the change.

Step-by-step: validating a domain

  • Add the domain on the Domains page. After adding, the banner reminds you: "Next step: click Validate on each new domain to verify ownership."
  • In the Ownership column the new domain shows a yellow Validate button. Click it (or use the row menu's "Validate ownership..." item) to open the Verify Domain Ownership window.
  • The window shows the exact Name and Value for the TXT record, each with a Copy button.
  • Add that TXT record at your DNS provider, then save it.
  • Back in DMARCER, click Recheck Now. If the record is found, the Ownership column changes to a green Validated badge.

You do not have to sit and wait on the window. DMARCER also checks in the background every few minutes, so a domain will turn green on its own once the record is live. Recheck Now simply lets you confirm it straight away.

Publishing automatically with a DNS integration

If the domain is linked to a DNS provider (for example Cloudflare, Azure DNS, Google Cloud DNS or ICUK), the ownership window shows an "Automated validation" panel naming that provider. Click Publish now and DMARCER will add the _DMARCER TXT record for you through the provider, then check it automatically. This does not affect your email delivery.

The panel appears for any linked domain. With white-label or custom nameservers it is not always possible to know in advance whether the record can be added, so DMARCER simply lets you try: if the provider will not accept the change you get a clear message, and if it works the domain validates on its own.

Validating many domains at once

To validate several domains together, tick them and choose "Validate selected" from the bulk actions menu. This option is only available when every domain you have selected is still unvalidated and is linked to a DNS provider, because it adds each domain's _DMARCER TXT record through that domain's own provider. The ownership checks then run automatically afterwards. As with a single domain, this does not affect your email delivery.

What validation unlocks, and how it stays accurate

Once a domain is validated it stays validated for as long as the record is in place. DMARCER keeps checking, and if the _DMARCER record is later removed or changed the domain goes back to unvalidated (it stays in your list but shows the Validate action again, and is held back from reporting until you validate it once more). Before marking a previously good domain as unvalidated, DMARCER does a second confirming lookup, so a brief DNS hiccup will not wrongly drop it.

Validating a domain can count towards your plan's domain allowance. If validating would take you over your plan's limit, DMARCER asks you to add a payment method first (so any extra can be billed) or to upgrade your plan. Account-managed plans that are allowed to go over without a card on file are invoiced separately. Domains that are already validated are never charged again when you recheck them.

Common pitfalls

  • Wrong host label: the record belongs on _DMARCER.yourdomain.com, not on the bare domain. Many providers want just the relative host _DMARCER; some want the full _DMARCER.yourdomain.com. Follow whichever your provider expects.
  • Altered value: copy the whole value including the dmarcer-verification= prefix, with no extra spaces. It has to match exactly (capitalisation does not matter), so an edited or shortened value will not pass.
  • Propagation delay: even though DMARCER checks live, your DNS provider still needs a few minutes to publish the change. If Recheck Now says "No matching _DMARCER TXT record found yet", wait a short while and try again.
  • Wrong record type: it must be a TXT record. SPF or other TXT entries on the domain do not get in the way, but the ownership value has to be its own TXT record on the _DMARCER label.
  • Removing the record later: do not delete the _DMARCER TXT record once the domain is validated. Removing it will send the domain back to unvalidated at the next check.

Was this article useful?

Be the first to vote.
Got feedback for our team? Send us a comment

Related articles

Adding a domain (MSP)

How to add a client's domain as an MSP, assign it to the right customer, and verify ownership so you can start monitoring.

Common DNS mistakes

Most email-security problems come down to a handful of common DNS mistakes. This guide explains the ones we see most often, what each does to your mail, and how to put it right with your DNS provider.

Adding client domains in bulk

How to add several client domains at once by pasting a list, with the same customer, region and licence type applied across the whole batch, then validating each one to confirm ownership.

I added the records but it will not verify

If you have added the verification record but your domain still will not validate, it is almost always a small mismatch in the host name or value. This article explains what we check and walks you through fixing the most common slips.