DMARC on cPanel: read reports and move from p=none to reject

DMARC tells receiving mail servers what to do with messages that claim to be from your domain but fail SPF and DKIM checks, and it sends you reports about who is using your domain. A policy of p=reject stops spammers from spoofing your address, but switching it on too early blocks your own legitimate mail. This guide shows the safe path.

Before you start

• SPF and DKIM must be valid first. Check cPanel → Email → Email Deliverability; see SPF, DKIM and DMARC basics.
• List every service that sends mail as your domain: your cPanel mailboxes and website, newsletter tools, CRM, invoicing, helpdesk, Google Workspace or Microsoft 365.

Step 1: publish a monitoring policy with reports

1. Create a mailbox or forwarder for reports, e.g. dmarc@example.com. Reports can be numerous, so a dedicated address is best.
2. Open cPanel → Domains → Zone Editor → Manage for the domain.
3. Edit (or add) the TXT record named _dmarc.example.com. with:
   Copy

   v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1; adkim=r; aspf=r

4. Save. p=none changes nothing for delivery; it only turns on reporting.

Step 2: read the aggregate reports

Large providers such as Google, Microsoft and Yahoo send a daily ZIP or GZ attachment with an XML file. Each record lists a sending IP, how many messages it sent, and whether SPF and DKIM passed and aligned with your domain.

• XML is hard to read by hand. Upload reports to a free DMARC report analyser, or a paid monitoring service, to get a readable overview by sender.
• Look for sources with failures. Typical findings: a newsletter tool without your DKIM key, a CRM sending through its own servers, or a forgotten old server.

Step 3: tighten the policy gradually

1. After two to four weeks of clean reports, change to quarantine for a portion of mail:
   Copy

   v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

2. Increase pct to 50 and then 100 over the following weeks while watching reports and user complaints.
3. Finally publish:
   Copy

   v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Subdomains and parked domains

• Use sp=reject to apply a policy to subdomains that do not send mail.
• Domains that never send email should publish v=spf1 -all and v=DMARC1; p=reject; to stop spoofing.

Troubleshooting

• No reports arrive: the rua address has a typo, or the mailbox rejects large attachments. If the report address is on another domain, that domain must publish an authorisation record.
• Gmail bounces with 5.7.26: your mail fails DMARC; see bounce errors.

Next steps

• Deliverability checklist
• Edit TXT records