Remove the t=y test flag from the DMARC record on Cloudflare

Why it matters

t=y is the RFC 9989 test flag: it asks receivers to apply a policy one level weaker than the one you published, so p=reject acts as quarantine and p=quarantine acts as none. It does not change the reports, and receivers that do not know the tag ignore it.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the Cloudflare dashboard open DNS > Records, edit the TXT record named _dmarc and delete t=y (and its semicolon), then save. Keep p= and the other tags as they are.

Type:     TXT
Name:     _dmarc.example.com
Content:  v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

# keep your current p= value; reject is shown as an example

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DMARC policy check
• Publish a DMARC record, starting in monitoring mode
• Keep only one DMARC record
• Fix the invalid DMARC record
• Move DMARC from monitoring to quarantine, then reject
• Move DMARC from quarantine to reject
• Remove the pct tag from the DMARC record
• Make the DMARC subdomain policy match the main policy
• Add a report address to the DMARC record
• Remove or fix the invalid tags in the DMARC record