---
title: DMARC
description: A DNS policy for what receivers should do when SPF or DKIM fails, plus aggregate reports to watch spoofing.
canonical: https://penasihathosting.com/en/hosting-wiki/dmarc
type: wiki
locale: en
updated: 2026-07-15
author: Willya Randika
---

# DMARC

## Overview

- **Summary:** A DNS policy for what receivers should do when SPF or DKIM fails, plus aggregate reports to watch spoofing.
- **Author:** Willya Randika ([profile](/penulis/willya-randika))

## Article

**DMARC** (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that tells receiving systems **what to do** when [SPF](/en/hosting-wiki/spf) or [DKIM](/en/hosting-wiki/dkim) fails, and where to send aggregate reports. The record is TXT at `_dmarc.yourdomain.com`.

DMARC turns authentication results into a domain decision: monitor only (`p=none`), quarantine, or reject. Without DMARC, your domain is easier to spoof for phishing. Most teams start in monitor mode so they do not accidentally block legitimate mail.

## A Simple Analogy

If SPF is the official courier list and DKIM is the wax seal, DMARC is the **gate security SOP**: “if the courier is unlisted or the seal is broken, hold or reject the package, then email headquarters a daily summary.”

## Example Record

```text
v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1
```

Start with `p=none` while you read RUA reports. After every legitimate sender looks healthy, tighten gradually to `quarantine`, then `reject` when ready.

## When to Tighten Policy

- All sending services have correct SPF includes  
- DKIM passes on primary paths (hosting mail, Google Workspace, transactional SMTP)  
- Reports no longer show large volumes of “legitimate” failures  
- Support can handle false positives from older partners  

## How It Relates to Hosting

On shared hosting you usually set DMARC in the DNS panel, not File Manager. [cPanel](/en/hosting-wiki/cpanel) Email Deliverability may suggest records. What matters is editing the active zone for your [nameservers](/en/hosting-wiki/nameserver).

## What to Watch For

- DMARC depends on **alignment**: the From domain must align with SPF/DKIM domains  
- Forwarding and mailing lists can be tricky; test before `reject`  
- Prepare a mailbox or parser service for XML reports  
- DMARC does not replace content-based spam filters  
- Edit the active zone and mind [TTL](/en/hosting-wiki/dns-ttl)  

## FAQ

<Accordion>
  <AccordionItem title="Should I jump straight to p=reject?">
    No. Start with `p=none`, fix senders, then tighten gradually.
  </AccordionItem>
  <AccordionItem title="SPF and DKIM pass but DMARC fails?">
    Often an alignment issue (From domain differs from the authenticated domain).
  </AccordionItem>
  <AccordionItem title="Does DMARC fix my website?">
    Not directly. It affects domain mail, brand spoofing risk, and trust in email.
  </AccordionItem>
  <AccordionItem title="Do I need a paid tool?">
    Not required. A report mailbox is enough to start; paid parsers help at higher volume.
  </AccordionItem>
</Accordion>