Setting up DMARC

DMARC (Domain‑based Message Authentication, Reporting, and Conformance) is an e‑mail authentication method that helps reduce spam and phishing by building on SPF and DKIM. It allows domain owners to specify how mail servers should handle unauthenticated messages and provides reporting for visibility.

Why DMARC Matters

• Prevents spammers from forging your domain in e‑mail headers.
• Improves deliverability by proving your messages are legitimate.
• Provides reports so you can monitor who is sending mail on behalf of your domain.

Configuring a DMARC TXT Record in cPanel

1. Log in to cPanel.

2. On the Tools page, in the Domains section, click Zone Editor.

3. Locate your domain → click Manage.

4. Click the down arrow next to Add Record → select Add TXT Record.

5. Enter the following values:

   • Name → _dmarc (cPanel will append your domain automatically, e.g., _dmarc.example.com)

   • TTL → 14400

   • Type → TXT

   • Record → Example configurations:

     • Monitor mode (reports only)

       v=DMARC1; p=none; rua=mailto:postmaster@example.com

     • Quarantine all failures

       v=DMARC1; p=quarantine; pct=100;

       Reject 50% of failures, quarantine the rest

       v=DMARC1; p=reject; pct=50;

6. Click Add Record.

7. Allow time for DNS propagation (up to 24 hours).

Testing the DMARC Record

• Windows

  nslookup -type=txt _dmarc.example.com

• Linux/macOS

  dig +short txt _dmarc.example.com

• Output should resemble:

  "v=DMARC1; p=none; rua=mailto:postmaster@example.com"

Configuring Mailing Lists for DMARC

Mailing list messages may be rejected or marked as spam if DMARC is strict. To improve compatibility:

1. Log in to cPanel → Mailing Lists → Manage.

2. In Mailman’s General Options, locate from_is_list.

3. Try Wrap Message first → test delivery.

4. If issues persist, switch to Munge From.

   • Wrap Message → replaces sender with list header.
   • Munge From → rewrites the From: header to use the list’s address.

Note

• DMARC is not yet fully standardized—different providers may handle policies differently.
• Start with monitor mode (p=none) to collect reports before enforcing stricter policies.
• Ensure SPF and DKIM are already configured for your domain.