How to Set Up DMARC in Gandi: Step-by-Step DNS Configuration

Gandi is a French domain registrar known across Europe for its straightforward approach to domain management. If your domain is registered with Gandi or you use Gandi's LiveDNS for name resolution, adding a DMARC record is a quick process through their admin panel. The same steps apply whether you have been with Gandi for years or recently landed there after the 2023 acquisition by TWS (team.blue).

This guide walks you through adding a DMARC TXT record in the Gandi DNS interface, handling SPF and DKIM if you use Gandimail, and verifying your record is live. If you have not built your DMARC record yet, start with our how to create a DMARC record guide.

Before You Start

Make sure you have these things ready before opening the Gandi admin panel.

SPF and DKIM should already be configured. DMARC relies on both protocols to authenticate email. SPF tells receiving servers which IP addresses can send email for your domain. DKIM adds a cryptographic signature so receivers can verify messages were not altered in transit. Without these in place, your DMARC record has nothing to evaluate. Use spfcreator.com for SPF and dkimcreator.com for DKIM if you still need to set them up.

Your domain's DNS must be managed by Gandi. If you registered your domain at Gandi but pointed your nameservers to another provider like Cloudflare, you need to add the DMARC record at that provider instead. DNS records added in the Gandi panel only work when Gandi's LiveDNS nameservers are active for your domain.

You need your DMARC record value ready. A solid starting record for monitoring looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

Start with p=none to collect reports without affecting email delivery. Move to enforcement only after reviewing your data. For help choosing between none, quarantine, and reject, see our DMARC policy levels guide.

Step-by-Step: Adding DMARC in Gandi

Gandi-Specific Considerations

Gandimail and Email Authentication

Gandi includes email hosting with domain registrations — two Gandimail mailboxes come bundled with every domain. If you use Gandimail to send email, you need to make sure your SPF record includes Gandi's mail servers. Check your existing TXT records for an SPF entry. If you are using Gandimail, your SPF record should include Gandi's sending infrastructure.

If you are not sure what your SPF record should look like, build one at spfcreator.com that includes all services sending email on behalf of your domain. This is especially important if you use Gandimail alongside a marketing platform like Mailchimp or SendGrid — both need to be covered in a single SPF record.

For DKIM, check your Gandimail settings for DKIM signing options. If DKIM is available and not yet enabled, activate it and confirm the corresponding DNS records are published. You can verify DKIM configuration at dkimcreator.com. For a detailed comparison of how SPF, DKIM, and DMARC work together, see SPF vs DKIM vs DMARC.

LiveDNS Propagation

Gandi's LiveDNS infrastructure provides fast DNS propagation. Changes to your DNS zone typically take effect within minutes rather than hours. This means your DMARC record should be resolvable shortly after you save it. However, some remote DNS resolvers may cache the absence of a record for a while, so allow up to an hour before troubleshooting if a lookup tool does not show your record immediately.

Gandi and team.blue

Gandi was acquired by TWS (part of the team.blue group) in 2023. The admin panel and DNS management interface remain functional, though some features and layouts may continue to evolve. The core process for adding DNS records has not changed, and the steps in this guide apply to the current Gandi interface.

Verifying Your DMARC Record

After saving the record in Gandi, give it a few minutes to propagate and then check it at dmarcrecordchecker.com. Enter your domain and verify:

• The record starts with v=DMARC1
• Your chosen policy (p=none, p=quarantine, or p=reject) is present
• The rua reporting address is correct if you included one
• There is only one DMARC record (no duplicates)

If the record does not appear after ten minutes, double-check that your domain's nameservers point to Gandi's LiveDNS. You can see this in the domain management section of the admin panel. If nameservers point elsewhere, add the record at that DNS provider instead.

Troubleshooting Common Issues

Record Not Resolving

If your DMARC record does not show up in a lookup tool, check these things:

• Nameserver mismatch. If your nameservers point to another provider, records added in the Gandi panel will not resolve publicly. Verify your active nameservers in the domain settings.
• Typo in the name field. The name must be exactly _dmarc with the underscore. If you entered dmarc without it or added the full domain, the record is at the wrong location.
• Duplicate records. If you have two TXT records at _dmarc, delete the incorrect one. Multiple DMARC records cause validation failures.

Updating Your Record Later

When you are ready to move from monitoring to enforcement, find your DMARC TXT record in the Gandi DNS records panel and click to edit it. Update the policy value and save. We recommend a gradual approach: start with p=quarantine; pct=10; to apply quarantine to only ten percent of failing messages. Monitor for a week, increase the percentage, and eventually move to p=reject once you are confident all legitimate email passes authentication. For the full enforcement path, see our DMARC policy levels guide.

After Setup: What to Expect

Once your DMARC record is live, receiving mail servers will start evaluating it immediately. If you included a rua tag, expect your first aggregate reports within 24 to 48 hours. These XML reports reveal which IP addresses sent email using your domain and whether those messages passed SPF and DKIM checks.

Review the reports carefully during the first few weeks. They will show whether any legitimate sending services are failing authentication. Fix any issues before moving to an enforcement policy. For a detailed look at DNS propagation timing, see our DMARC propagation time guide. If you manage multiple domains through Gandi or other registrars, our DNS hosting setup guides cover the process for each provider.

Monitor Your DMARC Record

You've created your DMARC record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.