A DMARC record tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks. Adding a DMARC record helps stop spammers from faking your address and improves how Gmail, Yahoo and Outlook treat your real messages. This guide shows you how to add a DMARC record in the cPanel Zone Editor of your Instant Access Internet Services account.
Before you start: set up SPF and DKIM
DMARC builds on SPF and DKIM, so those must be working first. In cPanel, go to Email > Email Deliverability and make sure your domain shows no problems. If it does, follow How to Set Up SPF and DKIM with Email Deliverability first.
If you also send mail through another service (a newsletter platform, Microsoft 365, Google Workspace, an online shop or a CRM), make sure that service is set up with SPF and DKIM for your domain too. Otherwise, a strict DMARC policy could send that mail to spam.
How to add a DMARC record in cPanel
These steps apply if your domain uses our nameservers. If your DNS is managed elsewhere, see the next section.
- In cPanel, go to Domains > Zone Editor.
- Click Manage next to your domain.
- Check that there isn't already a DMARC record: type
_dmarcin the search box. A domain must have only one. If one exists, edit it instead of adding another. - Click the arrow next to Add Record and choose the DMARC option. A form appears with a default DMARC record.
- Set Policy to None to start. This only monitors -- no mail is blocked.
- If you'd like reports, enter an address in Send Aggregate Mail Reports To, for example
dmarc@example.com. These are daily XML reports from big mail providers. They are technical, so only add this if you or your web person will read them (a free DMARC report service can turn them into readable charts). - Leave the other options (Subdomain Policy, DKIM Mode, SPF Mode, Percentage and the failure report settings) at their defaults unless you know you need to change them.
- Click Save Record.
Your finished record is a TXT record named _dmarc.example.com with a value such as:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
If you prefer, you can add exactly that as a normal TXT record instead (see How to Use the cPanel Zone Editor (A, CNAME, MX and TXT Records)).
If your DNS is hosted somewhere else
If your domain's nameservers aren't ours (for example, you use Cloudflare or your registrar's DNS), cPanel's Zone Editor won't affect your live DNS. Add the record at your DNS provider instead:
| Field | Value |
|---|---|
| Type | TXT |
| Name / Host | _dmarc (some providers want _dmarc.example.com) |
| Value / Content | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
| TTL | Default (or 3600) |
Which DMARC policy should you use?
| Policy | Record | What it does |
|---|---|---|
| None | p=none | Monitor only. Failing mail is delivered as normal. This meets Gmail and Yahoo's requirement for bulk senders and is the right place to start. |
| Quarantine | p=quarantine | Failing mail goes to the spam folder. |
| Reject | p=reject | Failing mail is refused. The strongest protection against people faking your domain. |
A safe path: run p=none for a few weeks. When you're sure every service that sends mail for your domain passes SPF or DKIM, change to p=quarantine, and later to p=reject if you want. To change the policy, go back to Zone Editor > Manage, find the _dmarc record and click Edit.
How to check your DMARC record
DNS changes can take a few minutes to a few hours to be seen everywhere (see DNS Propagation: Why Domain Changes Take Time and How to Check). Then:
- Use a free online DMARC checker (search for "DMARC record lookup") and enter your domain.
- Or send an email to a Gmail address, open it, click the three-dot menu and choose Show original. Look for DMARC: 'PASS'.
Common questions
Does Email Deliverability add DMARC for me?
Email Deliverability handles SPF and DKIM. Add DMARC yourself using the steps above.
My website's contact form emails started going to spam after I set p=reject
The form is probably sending mail From your visitor's address or through an outside service that isn't authorized. Set the form to send from an address on your own domain, or go back to p=none while you fix it (see Why Your Emails Go to Spam (and How to Fix It)).
Can I have two DMARC records?
No. If there are two, receiving servers ignore both. Combine what you need into one record.
I use Microsoft 365 or Google Workspace for email
You still need a DMARC record, and the steps are the same. Make sure SPF and DKIM are set up in that service first (see How to Use Microsoft 365 or Google Workspace Email with Your Domain).
Related guides
- How to Set Up SPF and DKIM with Email Deliverability
- Why Your Emails Go to Spam (and How to Fix It)
- How to Use the cPanel Zone Editor (A, CNAME, MX and TXT Records)
- How to Add a TXT Record to Verify Your Domain (Google, Microsoft and More)
- How to Use Microsoft 365 or Google Workspace Email with Your Domain
Still stuck? Open a support ticket and the Instant Access Internet Services team will help.
