Who This Is For / When to Use
Use this article if:
You see a DMARC error when sending email from Kyrios.
Emails are bouncing, rejected, or marked unsuccessful.
Your sending domain has a p=reject or p=quarantine DMARC policy.
You are unsure whether to use a shared sending domain or a dedicated sending domain.
What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol.
It verifies:
That the From email address domain
Matches the domain actually used to send the email
DMARC relies on SPF and DKIM alignment to validate messages. If alignment fails, receiving email providers follow the domain’s DMARC policy to decide whether to:
Deliver the email
Send it to spam
Reject it entirely
Why Emails Fail DMARC in Kyrios
Emails fail DMARC when:
The From email domain does not match the sending domain
The domain’s DMARC policy is set to p=reject or p=quarantine
A dedicated sending domain is not configured
When this happens, inbox providers may reject messages before delivery.
Example DMARC Error in Kyrios
This error means:
The From address domain has a p=reject DMARC policy
Emails sent through Kyrios shared domains will be rejected
Bounce rates will increase without a dedicated sending domain
Kyrios Sending Domain Types
Kyrios supports two types of sending domains.
Shared Sending Domain
What it is:
Emails are sent using Kyrios shared domains:
mg.msgsndr.netmg.msgsndr.org
Important details:
DMARC is not required for the shared domains themselves
DMARC issues occur when your From address domain has a strict policy
Example problem:
You send from [email protected]
Your DMARC record is:
v=DMARC1; p=reject
Inbox providers reject the email because:
The From domain (
test.com)Does not align with the shared sending domain
Temporary Fix: Relax the DMARC Policy
If you must send immediately and cannot configure a dedicated sending domain yet:
Log in to your DNS provider
Locate your DMARC TXT record
Change the policy from:
p=reject
or
p=quarantine
to:
p=none
Important notes:
This allows emails to be delivered even if DMARC fails
This should be temporary only
A relaxed policy reduces domain protection
Dedicated Sending Domain (Recommended Fix)
What it is:
A custom sending domain connected to your Kyrios account that aligns with your From address.
Why it works:
It ensures SPF, DKIM, and DMARC alignment.
Example:
From address:
[email protected]Dedicated sending domain:
mg.test.com
When configured correctly:
Emails pass DMARC
Messages are delivered successfully
Bounce rates are reduced
When You Must Use a Dedicated Sending Domain
You must configure a dedicated sending domain if:
Your domain uses p=reject or p=quarantine
You want consistent inbox delivery
You are sending campaigns or automated emails at scale
Common Issues and Fixes
Issue: Emails show “Unsuccessful” status
Fix: Configure a dedicated sending domain
Issue: High bounce rates
Fix: Align From address domain with sending domain
Issue: DMARC p=reject errors
Fix: Use a dedicated sending domain or temporarily set p=none
Issue: Unsure who manages DNS
Fix: Check where your domain was purchased (e.g., GoDaddy, Cloudflare, Namecheap)
Best Practices for DMARC in Kyrios
Always use a dedicated sending domain for production email
Monitor DMARC reports regularly
Start with
p=none, then move to stricter policiesAllow DNS changes time to propagate
Warm up new sending domains gradually
FAQ
What is DMARC and why is it important?
DMARC is an email authentication protocol that prevents spoofing by ensuring emails align with SPF and DKIM. It protects your domain and improves email deliverability.
Why are my emails failing DMARC in Kyrios?
This usually happens because your From address domain has a strict DMARC policy and you are sending through a shared domain without a dedicated sending domain configured.
How do I fix a p=reject DMARC error?
The correct fix is to configure a dedicated sending domain that matches your From address. As a temporary workaround, you can change your DMARC policy to p=none.
Is changing my DMARC policy to p=none safe?
It is safe as a temporary troubleshooting step, but it reduces protection against spoofing. A dedicated sending domain is the recommended long-term solution.
I don’t know who my DNS provider is. What should I do?
Your DNS provider is typically where you purchased your domain. Common providers include GoDaddy, Cloudflare, and Namecheap. You or your webmaster must update DNS records there.
Do I need DMARC for Kyrios shared domains?
No. DMARC is not required for Kyrios shared domains, but it is required for your own From address domain if it has a strict DMARC policy.