agentsiteaudit · Checks · Domain and email

DMARC record: stop people sending fake email from your domain

DMARC is a short line in your domain's DNS that tells receiving mail servers what to do with email that claims to come from you but fails its security checks. Without it, anyone can send convincing fake email using your address.

Our check passes when your DMARC policy is quarantine or reject, warns when it is only none (monitoring), and fails when there is no DMARC record at all.

In our November 2026 study of businesses selling to AI agents, 73% of the 1,190 websites we checked had no DMARC record or only a monitoring policy. See the full study.

Why it matters

Fake email from your domain can trick your customers and suppliers, and it damages your domain's reputation, so your real email is more likely to land in spam.

Gmail and Yahoo now require DMARC from businesses that send email in bulk, and many other providers treat a missing record as a warning sign.

What our check looks for

• Pass: DMARC with p=quarantine or reject
• Warning: DMARC with p=none
• Fail: No DMARC

Check ID dns.dmarc.present · Domain and email · Medium priority

How to fix it

Step 1: start with monitoring

_dmarc.example.co.uk.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk"

This changes nothing for delivery but sends you reports showing who is sending email as your domain. Leave it for two to four weeks.

Step 2: protect the domain

_dmarc.example.co.uk.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.co.uk"

Once the reports show your real email passes SPF and DKIM, move to quarantine, and later to reject.

A domain that never sends email

_dmarc.example.co.uk.  TXT  "v=DMARC1; p=reject"
example.co.uk.         TXT  "v=spf1 -all"

If nothing should ever send email from the domain, say so outright.

Adding it in cPanel

cPanel > Zone Editor > Manage > Add Record > TXT

The name is _dmarc followed by your domain. Check SPF and DKIM first under cPanel > Email Deliverability.

Common mistakes

• Going straight to p=reject before SPF and DKIM are set up, so your own invoices or booking emails are rejected.
• Two DMARC records on the same domain. Receiving servers then ignore both.
• Putting the record on the main domain instead of on _dmarc.
• Leaving p=none for ever. It reports but does not protect.

Related checks

• CAA record: choose who can issue certificates for your domain
• Tell AI agents who your business is: name and contact details as structured data

Written by Derek Moore, who builds and runs websites for small UK businesses. Last checked 30 October 2026.