Find your ingest address and publish your _dmarc DNS record

The recommended way to get DMARC data into Blankitt is direct ingest: every tenant gets a unique inbound address, and you publish it in your domain's _dmarc DNS record. Mailbox providers then send their daily aggregate reports straight to Blankitt, which ingests them automatically.

Step 1 — Find your ingest address

1. Open Settings.

2. Find your inbound ingest address at the top. It looks like:

   <token>@rua.blankitt.com
   

   The <token> part is unique to your account — copy the whole address exactly as shown.

Step 2 — Build your _dmarc TXT record

DMARC policy lives in a DNS TXT record at the host _dmarc under your domain (so _dmarc.yourcompany.com). If you're just starting out, begin with a monitor-only policy (p=none) so nothing is ever blocked while you gather data:

v=DMARC1; p=none; rua=mailto:<token>@rua.blankitt.com

Replace <token>@rua.blankitt.com with your own address from Settings. A few notes:

• v=DMARC1 and p=none are required to start; p=none means monitor only — receivers take no action, they just report.
• rua= is where aggregate reports are sent. This is the one that matters for monitoring.
• You can optionally add ruf=mailto:<token>@rua.blankitt.com to also request forensic (per-failure) reports, which appear on the Forensic page when providers send them.

If your domain already has a _dmarc record, don't add a second one — edit the existing record and add the rua=mailto:<token>@rua.blankitt.com tag to it (or point an existing rua= at your Blankitt address).

Step 3 — Add the record at your DNS provider

The exact screens vary by registrar/DNS host, but the steps are the same everywhere:

1. Sign in to wherever your domain's DNS is managed (for example GoDaddy, Cloudflare, Namecheap, Google Domains/Squarespace, IONOS, AWS Route 53).
2. Open the DNS / DNS management / Records area for your domain.
3. Add a new record and choose type TXT.
4. Set the Name / Host field to _dmarc.
   • Most providers want just _dmarc (they append your domain automatically).
   • A few want the full _dmarc.yourcompany.com.
   • On AWS Route 53, enter _dmarc as the record name.
5. Set the Value / Content field to your full record, for example:

   v=DMARC1; p=none; rua=mailto:<token>@rua.blankitt.com
   

6. Leave TTL at the default (often 1 hour / 3600 seconds).
7. Save the record.

Step 4 — Verify

DNS changes can take anywhere from a few minutes to a few hours to propagate. To check the record:

• Use the free public Blankitt DMARC checker at https://blankitt.com/dmarc/check.
• Or open the domain's detail page in the app, which shows your live DNS records (DMARC, SPF, DKIM, BIMI, MTA-STS, TLSRPT).

DNS record changes are tracked over time in the DNS Changelog.

What happens next

Once the record is live, mailbox providers start sending aggregate reports to your rua= address — typically about once a day. Blankitt ingests them automatically and your Dashboard, Offenders and domain scorecards begin to fill in. See How long until I see data?

Already have reports arriving in a mailbox?

If aggregate reports are already being delivered to a Microsoft 365 or Google Workspace inbox, you can import those instead of (or as well as) using direct ingest — see Connect a Microsoft 365 or Google Workspace mailbox.