webzod
account

Publish a DMARC record, starting in monitoring mode on Cloudflare

email.dmarc.missing · effort: about an hour

Why it matters

Without DMARC, receivers have no instruction for mail that fails SPF and DKIM, so anyone can send mail that claims to come from your domain. DMARC also sends you reports showing who is sending as you.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. In the Cloudflare dashboard select the domain, open DNS > Records and choose Add record.
  2. Type TXT, Name _dmarc (the full name shown in the snippet also works), Content the DMARC text from the snippet with your own report mailbox, TTL Auto, then save. TXT records are never proxied.
  3. Cloudflare also offers DMARC Management (Email > DMARC Management) which can collect and summarise the reports for you.
  4. Move p=none to p=quarantine and then p=reject only after the reports show all legitimate mail passing; edit the same record, never add a second one.
  5. For a domain that sends no mail, use p=reject straight away and leave out rua (or point it at a mailbox on a domain that does receive mail, which must publish a TXT record at example.com._report._dmarc.<that domain> with the value v=DMARC1). Only if no mailbox uses this domain, you can also add a null MX: Type MX, Name @, Mail server . (a single dot), Priority 0. If the dashboard rejects the dot, skip the null MX; SPF -all and DMARC p=reject are what stop spoofing.
text 
Type:     TXT
Name:     _dmarc.example.com
Content:  v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
TTL:      Auto

# Domain that sends no mail, Content:
# v=DMARC1; p=reject
# Only if no mailbox uses this domain, optional null MX:
# Type: MX   Name: @   Mail server: .   Priority: 0

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.