Description
Ensure the domain has a DMARC TXT record named _dmarc, starting with v=DMARC1, with an enforcement policy of p=quarantine or p=reject. This tells receiving servers what to do with mail that fails SPF and DKIM checks.
Rationale
SPF and DKIM only check mail; DMARC tells receivers how to act on the result. With p=none, spoofed messages are still delivered. An enforcement policy makes receivers quarantine or reject messages that fail the checks, which greatly reduces phishing that impersonates your domain.
Impact
Spoofed mail is sent to spam or rejected
Reports show who is sending mail for your domain
Legitimate mail that fails SPF or DKIM will also be quarantined or rejected
Default Value
By default, no DMARC record exists.
Pre-Requisites
Cloudflare account with Administrator or DNS permissions for the zone
SPF and DKIM already set up and passing for legitimate mail
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to DNS > Records.
Filter by Type TXT and find the record named _dmarc.
Verify that it starts with v=DMARC1 and contains p=quarantine or p=reject.
If there is no DMARC record or it uses p=none, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to DNS > Records.
Select Add record (or Edit the existing record) with Type TXT and Name _dmarc.
Enter the Content, for example: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@<your-domain>
Select Save.
After confirming that legitimate mail passes, you can change p=quarantine to p=reject.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to DNS > Records.
Select Edit on the _dmarc record, change the policy back to its previous value (for example, p=none), and select Save.
Reference