DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that tells receiving systems what to do when SPF or DKIM fails, and where to send aggregate reports. The record is TXT at _dmarc.yourdomain.com.

DMARC turns authentication results into a domain decision: monitor only (p=none), quarantine, or reject. Without DMARC, your domain is easier to spoof for phishing. Most teams start in monitor mode so they do not accidentally block legitimate mail.

A Simple Analogy

If SPF is the official courier list and DKIM is the wax seal, DMARC is the gate security SOP: “if the courier is unlisted or the seal is broken, hold or reject the package, then email headquarters a daily summary.”

Example Record

v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Start with p=none while you read RUA reports. After every legitimate sender looks healthy, tighten gradually to quarantine, then reject when ready.

When to Tighten Policy

• All sending services have correct SPF includes
• DKIM passes on primary paths (hosting mail, Google Workspace, transactional SMTP)
• Reports no longer show large volumes of “legitimate” failures
• Support can handle false positives from older partners

How It Relates to Hosting

On shared hosting you usually set DMARC in the DNS panel, not File Manager. cPanel Email Deliverability may suggest records. What matters is editing the active zone for your nameservers.

What to Watch For

• DMARC depends on alignment: the From domain must align with SPF/DKIM domains
• Forwarding and mailing lists can be tricky; test before reject
• Prepare a mailbox or parser service for XML reports
• DMARC does not replace content-based spam filters
• Edit the active zone and mind TTL

FAQ