# Publish a DMARC record
Source: https://docs.webgee.com/en/email/publishing-dmarc-records-on-your-cpanel-domain







Publish a DMARC record for your domain. Applies to shared, reseller and Premium
hosting.

DMARC builds on SPF and DKIM. Those two say whether a message is authentic;
DMARC tells receiving servers what to do when it is not, and asks them to report
back.

## Before you begin [#before-you-begin]

DMARC does nothing without SPF and DKIM in place first — a DMARC record on a
domain with no SPF will start failing your own legitimate mail.

* **SPF** — see
  [SPF records for WebGee hosting](/en/email/what-are-the-correct-spf-records-when-using-webgee-hosting)
* **DKIM** — enabled per domain under **cPanel → Email Deliverability**

  <img alt="The DKIM section of Email Deliverability" src="__img0" />

Check both show as valid under **cPanel → Email Deliverability** before
continuing.

## Add the record [#add-the-record]

The quickest route is **Email Deliverability**, which builds the record for you.

1. In cPanel, open **Email Deliverability** and select **Manage** beside your
   domain.

2. Scroll to the **DMARC** section.

   <img alt="The DMARC section offering a suggested record" src="__img1" />

3. Select **Install The Suggested Record**.

The suggested record is `v=DMARC1; p=none;` — monitoring only, which is the
right place to start. Add a reporting address afterwards, as below.

<Callout type="warn">
  If your nameservers are not WebGee's, cPanel warns that it does not control
  DNS for the domain and that installing the record **will not be effective**.
  The button still works and still reports success — it writes to a zone nothing
  queries. Add the record at your actual DNS provider instead.
</Callout>

### Or add it by hand [#or-add-it-by-hand]

Where DNS is in cPanel and you want a specific value:

1. In cPanel, open **Zone Editor** under **Domains**.

2. Select **Manage** beside your domain.

3. Add a record:

   | Field | Value     |
   | ----- | --------- |
   | Type  | `TXT`     |
   | Name  | `_dmarc`  |
   | TTL   | `3600`    |
   | Value | see below |

4. Select **Add Record**.

## Choose a policy [#choose-a-policy]

Start permissive and tighten later. A strict policy published before you know
what is sending on your behalf will silently reject your own mail.

**Start here** — monitor only, changes nothing about delivery:

```
v=DMARC1; p=none; rua=mailto:dmarc@example.com
```

**Then**, once reports show only legitimate sources failing:

```
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com
```

**Finally**, when you are confident:

```
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@example.com
```

| Tag            | Meaning                                  |
| -------------- | ---------------------------------------- |
| `p=none`       | Take no action, just report              |
| `p=quarantine` | Deliver failures to spam                 |
| `p=reject`     | Refuse failures outright                 |
| `rua=`         | Where aggregate reports are sent         |
| `pct=`         | Percentage of mail the policy applies to |

<Callout type="warn">
  Do not start at `p=reject`. Marketing platforms, invoicing systems, CRMs and
  helpdesks commonly send as your domain. Any that are not covered by your SPF
  and DKIM will stop being delivered the moment you publish it — with no bounce
  you will see.
</Callout>

## Check it worked [#check-it-worked]

```bash
dig +short TXT _dmarc.example.com
```

Your record should come back. DNS changes take up to an hour to propagate.

You can also confirm it under **cPanel → Email Deliverability**, which validates
SPF, DKIM and DMARC together.

## Reading the reports [#reading-the-reports]

The address in `rua=` receives daily XML reports from receiving providers. They
are not readable by hand — paste one into any free DMARC report analyser, or use
a monitoring service.

You are looking for sources that are sending as your domain and failing. Each is
either something legitimate you need to add to SPF, or someone spoofing you.

## Related [#related]

* [SPF records for WebGee hosting](/en/email/what-are-the-correct-spf-records-when-using-webgee-hosting)
* [Why are my emails being marked as spam?](/en/email/why-are-my-emails-being-marked-as-spam)
* [Get the full headers of an email](/en/email/how-to-obtain-email-headers-a-step-by-step-guide)