_dmarc can be a CNAME, so the record itself can live with whoever processes your reports. Several large organisations do this; it is worth knowing what it buys and what it hands over.
A live one
_dmarc.hmrc.gov.uk.dmarc.has.pphosted.com. "v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com, mailto:Dmarc.Aggregate@hmrc.gov.uk,mailto:dmarc-rua@dmarc.service.gov.uk; ..."
Two things are visible. The policy record is not in HMRC’s zone at all, and the reports go to three destinations — the processor, a departmental mailbox, and a cross-government collector. The second and third exist because delegation should not mean losing your own copy.
The trade
| Record in your zone | Delegated by CNAME | |
|---|---|---|
| Who can change the policy | You | The processor |
| Speed of a change | Your DNS change process | A click in their console |
| Speed of a rollback | Same | Depends on their availability |
| Auditability | Your zone history | Their change log, if they keep one |
| Failure mode | You publish something wrong | They publish something wrong, or the target disappears |
The argument for delegation is real: a processor can move you through a staged rollout without a DNS ticket per step, and a rollback is immediate rather than queued behind a change window. The argument against is that p is the single most consequential tag in your mail configuration, and it now changes without touching your zone.
If you do it
- Keep a
ruadestination of your own in the delegated record, as HMRC does. Losing independent visibility into your own mail is a much worse outcome than a slow change process. - Monitor the resolved record, not your zone. Your zone contains a CNAME and nothing else, so a check that reads it proves nothing about what policy is in force.
- Alert on the policy changing. If
pmoves and you did not move it, you want to know within the hour. - Know what happens at the end of the contract. A dangling
_dmarcCNAME means no policy at all — which is a worse outcome than a stale one.
A CNAME cannot coexist with a TXT at the same name
If _dmarc.example.com already holds a TXT record, the CNAME cannot be added cleanly. Remove the TXT first, and expect a brief window with no policy — which is a reason to do this at p=none rather than mid-enforcement.