Missing dmarc
Quick winAdd a DMARC DNS TXT record at _dmarc.yourdomain.com to tell receiving mail servers how to handle emails that fail authentication checks for your domain.
What it is
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a free email security standard that works alongside SPF and DKIM. You publish a single DNS TXT record at a special subdomain (_dmarc.yourdomain.com) that tells the world's mail servers what to do when someone sends an email pretending to be from your domain — for example, whether to let it through, quarantine it to spam, or reject it outright. Without this record, anyone on the internet can spoof your brand's email address and there is nothing in place to stop it or report it to you.
Why it matters
Without a DMARC record, criminals can send phishing emails that appear to come from your store's domain — stealing customer passwords, payment details, or credentials — and your brand takes the reputational hit. Google and Yahoo now require DMARC for bulk senders, meaning stores without it face deliverability problems: legitimate order confirmations, shipping notices, and marketing emails are more likely to land in spam or be rejected entirely. This directly harms revenue through lost transactional emails and undelivered promotions. OWASP classifies this under A05:2021 Security Misconfiguration because a missing DMARC record is a straightforward, avoidable configuration gap that exposes your customers and business to serious harm.
How to fix it
- Confirm your domain already has SPF and DKIM records published — DMARC builds on both. If either is missing, add them first or your DMARC policy will block legitimate mail.
- Log in to the DNS provider where your domain's nameservers are hosted (this is often your domain registrar, e.g. GoDaddy, Namecheap, Cloudflare — NOT your hosting or ecommerce platform).
- Create a new DNS TXT record with the Host/Name set to _dmarc (or _dmarc.yourdomain.com if your DNS panel requires the full name) and TTL set to 3600 (1 hour).
- Set the Value to: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com — start with p=none so you receive reports without blocking any mail, then review the reports for 2–4 weeks.
- After reviewing reports and confirming legitimate mail passes authentication, tighten the policy to p=quarantine (spam folder) and eventually p=reject (block entirely).
- Use a free DMARC record checker (search 'DMARC lookup tool') to verify the record is live and correctly formatted before moving to a stricter policy.
Fix it on your platform
Pick your platform for the exact steps.
How to fix missing dmarc on Shopify
- DMARC is a DNS record — it is not set inside Shopify's admin. You must go to wherever your domain's DNS is managed.
- If you bought your domain through Shopify: go to Shopify Admin → Settings → Domains → click your domain → click 'Manage DNS settings'. Add a TXT record: Host = _dmarc, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
- If your domain DNS is managed elsewhere (Cloudflare, GoDaddy, Namecheap, etc.), log in to that provider's DNS dashboard and add the TXT record there.
- Shopify's built-in SPF and DKIM records for Shopify Email are added automatically when you verify your sender domain under Settings → Email → Sender email address — complete that step first so DMARC has valid SPF/DKIM to align against.
How to fix missing dmarc on WooCommerce
- WooCommerce runs on WordPress and does not manage DNS. Log in to your hosting provider's control panel (cPanel, Plesk, or a standalone DNS dashboard like Cloudflare).
- In cPanel: navigate to Domains → Zone Editor → click 'Manage' next to your domain → Add Record → Type: TXT, Name: _dmarc, TTL: 3600, Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com → Save.
- Ensure your outgoing WordPress email (via WP Mail SMTP or similar plugin) is authenticated with SPF and DKIM at your mail provider (e.g. SendGrid, Mailgun, Google Workspace) before enforcing a strict DMARC policy.
- Install a plugin like 'WP Mail SMTP' (Settings → WP Mail SMTP → Setup Wizard) to route mail through an authenticated SMTP provider that supports DKIM, then publish DMARC.
How to fix missing dmarc on BigCommerce
- BigCommerce does not manage DNS. Go to the DNS provider where your domain is registered or delegated (e.g. Cloudflare, GoDaddy).
- Add a TXT record: Host/Name = _dmarc, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL = 3600.
- In BigCommerce Admin → Settings → Email, verify that transactional emails are sent through BigCommerce's own SMTP or a connected provider. Check that provider's dashboard for DKIM signing — most (Mailchimp Transactional, SendGrid) provide DKIM DNS records to add alongside DMARC.
- Only escalate DMARC to p=quarantine or p=reject after verifying DKIM/SPF pass in aggregate reports.
How to fix missing dmarc on Wix
- If your domain was purchased through Wix: go to Wix Dashboard → Domains → … (three dots) next to your domain → Manage DNS Records.
- Click '+ Add Record', choose TXT, set Host to _dmarc, Value to v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL to 3600, and save.
- If your domain DNS is external (pointed to Wix via nameservers but managed elsewhere), add the record in that external DNS provider's dashboard instead.
- Wix sends transactional email from Wix infrastructure. Ensure your sender email domain is verified in Wix under Settings → Email Marketing or Wix Inbox to activate DKIM/SPF before enforcing a strict DMARC policy.
How to fix missing dmarc on Squarespace
- If your domain is registered with Squarespace: go to Squarespace Dashboard → Domains → click your domain → DNS Settings → Add Record → Type: TXT, Host: _dmarc, Data: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL: 3600 → Save.
- If your domain DNS is managed outside Squarespace (e.g. at GoDaddy), add the TXT record there.
- Squarespace Commerce sends transactional email (order confirmations etc.) via Squarespace's own servers, so SPF/DKIM for that path is managed by Squarespace. If you use Google Workspace or another external mail provider for your From: address, add that provider's DKIM record first.
- After publishing the DMARC record at p=none, monitor reports for 2–4 weeks before tightening the policy.
How to fix missing dmarc on Webflow
- Webflow does not manage DNS. If your domain was purchased through Webflow, DNS is managed via Webflow's dashboard: go to Designer → Project Settings → Hosting → click the domain → Edit DNS.
- Add a TXT record: Name = _dmarc, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL = 3600.
- If your DNS is managed externally (Cloudflare, etc.), log in there and add the same TXT record.
- Webflow does not send transactional commerce email natively — you'll be using an integration (Shopify Buy Button, Foxy.io, or a custom setup). Verify DKIM/SPF at whichever mail provider handles your outgoing email before tightening DMARC policy.
How to fix missing dmarc on Adobe Commerce (Magento)
- Adobe Commerce does not manage DNS. Log in to your server's hosting control panel or standalone DNS provider (Cloudflare, Route 53, etc.).
- Add a DNS TXT record: Name = _dmarc.yourdomain.com (or _dmarc if the UI appends the domain), Type = TXT, TTL = 3600, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
- In Adobe Commerce Admin → Stores → Configuration → Advanced → System → Mail Sending Settings, confirm outgoing email is routed through an authenticated SMTP relay (SendGrid, Mailgun, Amazon SES) that provides DKIM signing.
- Add that SMTP provider's DKIM TXT record(s) to your DNS first, then publish DMARC at p=none to gather reports before escalating to quarantine or reject.
How to fix missing dmarc on Headless / Custom (I build in code)
- Log in to your authoritative DNS provider (Cloudflare, Route 53, Google Cloud DNS, etc.) — whichever hosts your domain's NS records.
- Add a TXT record: Name = _dmarc (or _dmarc.yourdomain.com), TTL = 3600, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- Ensure your mail-sending service (SES, SendGrid, Postfix, etc.) has DKIM signing enabled and that an SPF record already exists for your domain.
- After 2–4 weeks of aggregate report review, tighten to p=quarantine, then p=reject. Consider adding pct=100 and a forensic ruf address for full coverage.
How to fix missing dmarc on PrestaShop
- PrestaShop does not control DNS. Access your hosting control panel (cPanel/Plesk) or external DNS provider.
- Add TXT record: Name = _dmarc, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL = 3600.
- In PrestaShop Back Office → Advanced Parameters → Email, configure SMTP to use an authenticated provider (SendGrid, Mailgun) that supplies DKIM keys, then add those DKIM DNS records before enforcing DMARC.
How to fix missing dmarc on BigCommerce for WP
- DNS is managed at your domain registrar or DNS provider — not inside WordPress or BigCommerce.
- Add a TXT record at your DNS provider: Host = _dmarc, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL = 3600.
- Ensure transactional email sent via BigCommerce's SMTP is DKIM-signed (configure under BigCommerce Admin → Settings → Email), then publish the DMARC record.
How to fix missing dmarc on Shopify Plus
- Same DNS process as Shopify above — DMARC is a DNS-level record independent of Shopify Plus features.
- Shopify Plus merchants often use custom transactional email platforms (Klaviyo, Bronto, etc.): before enforcing DMARC, check each sending platform's documentation to ensure SPF and DKIM are configured for your domain in that platform.
- If you use Shopify's built-in email (Shopify Email): authenticate your sender domain under Settings → Email Marketing → Sender Domain and follow the SPF/DKIM setup steps so Shopify Email passes DMARC alignment before you set p=reject.
How to fix missing dmarc on Wix Studio
- In Wix Studio, open the site project and go to the Site Dashboard → Settings → Domains.
- Follow the same DNS steps as Wix above — either manage the TXT record in Wix's DNS panel (if the domain is Wix-managed) or log in to your external DNS provider.
- Add a TXT record: Host = '_dmarc', Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- Ensure any transactional email (Wix automations, contact forms) is authenticated with SPF/DKIM via Wix's email settings before escalating to p=quarantine.
How to fix missing dmarc on Magento Open Source
- Same DNS and mail-authentication process as Adobe Commerce above — DMARC is purely a DNS TXT record managed at your registrar or DNS host.
- Add TXT record at _dmarc.yourdomain.com with value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- Configure SMTP authentication in Magento Open Source via Stores → Configuration → Advanced → System → Mail Sending Settings, pointing to an SPF/DKIM-enabled relay.
- Use a community SMTP extension from the Magento Marketplace to enable authenticated outbound mail if the default server configuration does not support it.
Does your site have this issue?
Run a free SEOLZ scan to find missing dmarc — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing dmarc?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a free email security standard that works alongside SPF and DKIM. You publish a single DNS TXT record at a special subdomain (_dmarc.yourdomain.com) that tells the world's mail servers what to do when someone sends an email pretending to be from your domain — for example, whether to let it through, quarantine it to spam, or reject it outright. Without this record, anyone on the internet can spoof your brand's email address and there is nothing in place to stop it or report it to you.
Why does missing dmarc matter?
Without a DMARC record, criminals can send phishing emails that appear to come from your store's domain — stealing customer passwords, payment details, or credentials — and your brand takes the reputational hit. Google and Yahoo now require DMARC for bulk senders, meaning stores without it face deliverability problems: legitimate order confirmations, shipping notices, and marketing emails are more likely to land in spam or be rejected entirely. This directly harms revenue through lost transactional emails and undelivered promotions. OWASP classifies this under A05:2021 Security Misconfiguration because a missing DMARC record is a straightforward, avoidable configuration gap that exposes your customers and business to serious harm.
How do I fix missing dmarc?
Add a DMARC DNS TXT record at _dmarc.yourdomain.com to tell receiving mail servers how to handle emails that fail authentication checks for your domain.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP