# DMARC Recommended Settings for Server with 250 Domains

**URL:** <https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616>\
**Category:** Virtualmin\
**Created:** [July 28, 2021, 8:38am UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616 "2021-07-28T08:38:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vander.host](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/vander.host/32/4430_2.png) [@vander.host](https://forum.virtualmin.com/u/vander.host)\
**Post date:** [July 28, 2021, 8:38am UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616/1 "2021-07-28T08:38:50Z")

</div>

We have a server with 250 domains. We need to choose one setting for DMARC that would be generally applicable to most domains. I don’t want to get too specific on the technicalities and will face those when they appear.

Would “Enable: Yes and Quarantine and 100% of messages” for example be a good default?

Any other suggestions?

---

<div class="post-metadata">

**Author:** ![calport](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/calport/32/44_2.png) [@calport](https://forum.virtualmin.com/u/calport)\
**Post date:** [July 28, 2021, 10:11am UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616/2 "2021-07-28T10:11:40Z")

</div>

![image](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/c0b41961cf8335339ab68cc8f33cc1afbb7b961c.png)

One setting for all 250 domains on the server is the only sane way to do this. Please refer to the screenshot above of a production server, vps02. In this I have deviated from default and forced the selector to be vps02 so that the domains I host on the server will then have:  
`vps02._domainkey.domain1.tld`  
`vps02._domainkey.domain2.tld`  
and so on…

This helps when there are multiple servers and multiple domains to be managed - one is able to identify the server that a DKIM records belongs to just by looking at it and equally importantly, keep redundant not colliding DNS records for DKIM. For example, for domainx.tld:  
`vps02._domainkey.domainx.tld` used before migration  
`vps03._domainkey.domainx.tld` needed after migration

---

<div class="post-metadata">

**Author:** ![vander.host](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/vander.host/32/4430_2.png) [@vander.host](https://forum.virtualmin.com/u/vander.host)\
**Post date:** [August 2, 2021, 7:15pm UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616/3 "2021-08-02T19:15:27Z")

</div>

Thanks @calport but I’m referring to DMARC not DomainKeys. See screenshot:

![image](https://cdn.forum.virtualmin.com/uploads/default/original/2X/9/94d2ab0be67c7937306343dd6be0a4c5b34b49e8.png)

Options are only enable or disable and then:

- Take no action
- Quarantine email
- Reject email

Then % of message applied to.

For now we’re going with:

- Enable
- Quarantine
- 100% of messages

---

<div class="post-metadata">

**Author:** ![toreskev](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/toreskev/32/160_2.png) [@toreskev](https://forum.virtualmin.com/u/toreskev)\
**Post date:** [August 3, 2021, 4:17am UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616/4 "2021-08-03T04:17:41Z")

</div>

```auto
virtualmin modify-dns --dmarc --all-domains

```

That should do it, I think?  
Just make sure that the DMARC settings are those you require under ‘System Settings → Server Templates’ first.

---

<div class="post-metadata">

**Author:** ![vander.host](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/vander.host/32/4430_2.png) [@vander.host](https://forum.virtualmin.com/u/vander.host)\
**Post date:** [August 3, 2021, 5:11am UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616/5 "2021-08-03T05:11:29Z")

</div>

I did more research and found this:

> **Quarantine policy _p=quarantine_** With the DMARC policy quarantine, Internet Service Providers which have adopted DMARC will put emails which are failing the DMARC check in special ‘quarantine’ folders e.g. the junk or spam folder. The p=quarantine DMARC policy influences the way email is handled, however failing emails will still arrive.

> **[What is a DMARC Policy?](https://www.mimecast.com/content/dmarc-policy/)**
>
> A DMARC policy authenticates emails automatically, filtering out suspicious emails. Learn how to customize your DMARC policy options with Mimecast.

It seems quarantine is the most logical, since it stores failed DMARC message in the SPAM folder. Will stick to that for now.

---

<div class="post-metadata">

**Author:** ![system](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/cd96d761e326db4b2bef94886a639109bd7a8e76.svg) [@system](https://forum.virtualmin.com/u/system)\
**Post date:** [October 2, 2021, 5:12am UTC](https://forum.virtualmin.com/t/dmarc-recommended-settings-for-server-with-250-domains/111616/6 "2021-10-02T05:12:25Z")

</div>

Closed on October 2, 2021, 5:12am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.