{"id":18979,"date":"2026-10-22T17:00:15","date_gmt":"2026-10-22T14:00:15","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/what-is-dmarc\/"},"modified":"2026-10-22T17:00:17","modified_gmt":"2026-10-22T14:00:17","password":"","slug":"what-is-dmarc","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/what-is-dmarc\/","title":{"rendered":"What Is DMARC and How to Stop People Spoofing Your Company Email, Step by Step"},"content":{"rendered":"
\n
In short<\/b>DMARC is a record you add to your domain\u2019s DNS that tells mail servers such as Gmail and Outlook what to do with a message claiming to be from your domain that fails SPF or DKIM: accept it, send it to spam, or reject it. This stops fraudsters sending messages in your company\u2019s name, and improves delivery of your real messages.<\/div>\n
\"DMARC:<\/figure>\n

Why do you need it?<\/h2>\n
\n
1<\/i>Stop spoofing<\/b>Without DMARC, anyone can send a message showing info@yourcompany.com as the sender.<\/span><\/div>\n
2<\/i>Better delivery<\/b>Mail servers trust domains that apply SPF, DKIM and DMARC together.<\/span><\/div>\n
3<\/i>Reports<\/b>It sends you reports on who sends mail in your domain\u2019s name.<\/span><\/div>\n<\/div>\n

How does it work with SPF and DKIM?<\/h2>\n
\n\n\n\n\n\n\n\n
Record<\/th>\nWhat it proves<\/th>\n<\/tr>\n<\/thead>\n
SPF<\/td>\nThat the sending server is allowed to send for your domain.<\/td>\n<\/tr>\n
DKIM<\/td>\nThat the message is digitally signed by your domain and was not altered. Read what DKIM is<\/a>.<\/td>\n<\/tr>\n
DMARC<\/td>\nWhat mail servers should do if the checks fail, and where to send reports.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

So enable SPF and DKIM first. Read enabling SPF and DKIM in cPanel<\/a>.<\/p>\n

Steps to add DMARC<\/h2>\n
    \n
  1. Confirm SPF and DKIM:<\/b> They must be enabled and correct before DMARC.<\/li>\n
  2. Add a TXT record:<\/b> From the Zone Editor in cPanel, or from DNS management in the client area<\/a>. The name is _dmarc<\/code> and the value is like the example below.<\/li>\n
  3. Start with the monitoring policy p=none:<\/b> No message is affected, but you receive reports for two to four weeks.<\/li>\n
  4. Review the reports:<\/b> Make sure every system that sends in your name (your site, billing system, marketing tools) passes the checks.<\/li>\n
  5. Tighten the policy gradually:<\/b> Move to p=quarantine<\/code> (spam), then p=reject<\/code> (reject) once you are sure.<\/li>\n<\/ol>\n
    _dmarc.example.com   TXT   "v=DMARC1; p=none; rua=mailto:dmarc@example.com"<\/pre>\n
    Do not start with reject:<\/b> if a system sends in your name without correct SPF and DKIM, its real messages will be rejected. Start with none and monitor.<\/div>\n
    Major mail providers such as Gmail and Yahoo require DMARC for bulk senders. Also read about phishing emails<\/a>.<\/p>\n
    \n
    Your company email with Hyyat Host<\/h2>\n