The fix, in one snippet
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1"Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
Scan.now queries the TXT record at _dmarc.<domain>. A valid record begins with v=DMARC1 and contains a p= tag with the value none, quarantine or reject. The check fails when there is no record, when more than one record exists, or when the required tags are missing or malformed. If the scanned host is a subdomain with no record of its own, Scan.now checks the organisational domain as RFC 7489 section 6.6.3 describes. It also reads the reporting tags: when rua= points to an address on a different domain, it verifies the authorisation record that domain must publish (<yourdomain>._report._dmarc.<reportdomain>), and it notes pct values below 100 and any sp= subdomain policy. The strength of the policy itself is scored separately in dmarc-policy-none.
Why it matters
SPF and DKIM each answer a narrow question; DMARC connects them to the address the recipient actually sees. It requires that whichever check passes is aligned with the From: header domain, and it tells the receiver what to do when neither is: deliver anyway, quarantine, or reject. Without DMARC, a message can fail SPF and DKIM outright and still be delivered with your name on it, and you never learn it happened. With even a monitoring-only record, providers send you daily aggregate reports listing every server that sent mail claiming your domain, which is how you discover a forgotten newsletter tool or an ongoing spoofing campaign. DMARC has also become a delivery requirement: since February 2024 Google and Yahoo require senders of more than 5,000 messages a day to a domain to publish a DMARC policy, and Microsoft applied a comparable rule to Outlook.com in 2025. The SPF, DKIM and DMARC guide covers alignment and the rollout in depth.
How to fix it
Publish a monitoring record first; it changes nothing about delivery but starts the reports flowing:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"In the Cloudflare DNS dashboard: Type TXT, Name _dmarc, Content as above; Cloudflare's DMARC Management feature can also receive and summarise the reports for you. If the reports should go to a third-party analyser on another domain, that domain must publish an authorisation record, which most services set up for you:
example.com._report._dmarc.dmarc-analyser.example. IN TXT "v=DMARC1"Once SPF and DKIM are in place for every legitimate sender and the reports are clean, move to enforcement in steps:
"v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]"
"v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]"
"v=DMARC1; p=reject; rua=mailto:[email protected]; sp=reject; adkim=s; aspf=s"Check with dig +short TXT _dmarc.example.com or the email security checker.
Where this fits
DMARC record is check 2 of 8 that the website vulnerability scanner runs under dns and email authentication, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits SPF record is too permissive (high), where the SPF record ends in +all or ?all, omits the all mechanism, or authorises very large address ranges, so a forged message from almost anywhere still passes the SPF check. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
DMARC record closes one route in. Immediately below it: SPF record, where the domain publishes no valid SPF record, or publishes more than one, so receiving mail servers cannot tell which hosts are allowed to send mail as your domain; CAA record, where no CAA record limits which certificate authorities may issue certificates for the domain, so any of the hundred-plus publicly trusted CAs could be induced to issue one; DMARC policy is p=none (monitoring only), where the DMARC record exists but uses p=none, so receivers are asked to deliver spoofed mail normally.
Found in the same scan
The website vulnerability scanner reports this alongside checks from other categories that are at least as serious, including Certificate chain and hostname validation, where the certificate presented for this hostname did not validate: The chain does not reach a trusted root, an intermediate is missing, the name does not match, or the certificate is self-signed or expired, and Exposed .env configuration file, where a .env configuration file is served from the web root. A single run of website vulnerability scanner answers all of them at once.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: DMARC record (medium severity)
Scanner check id: dmarc-recordThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
