How to fix missing dmarc on Webflow

Steps for Webflow

1. Webflow does not manage DNS. If your domain was purchased through Webflow, DNS is managed via Webflow's dashboard: go to Designer → Project Settings → Hosting → click the domain → Edit DNS.
2. Add a TXT record: Name = _dmarc, Value = v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, TTL = 3600.
3. If your DNS is managed externally (Cloudflare, etc.), log in there and add the same TXT record.
4. Webflow does not send transactional commerce email natively — you'll be using an integration (Shopify Buy Button, Foxy.io, or a custom setup). Verify DKIM/SPF at whichever mail provider handles your outgoing email before tightening DMARC policy.

What is missing dmarc?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a free email security standard that works alongside SPF and DKIM. You publish a single DNS TXT record at a special subdomain (_dmarc.yourdomain.com) that tells the world's mail servers what to do when someone sends an email pretending to be from your domain — for example, whether to let it through, quarantine it to spam, or reject it outright. Without this record, anyone on the internet can spoof your brand's email address and there is nothing in place to stop it or report it to you.

Without a DMARC record, criminals can send phishing emails that appear to come from your store's domain — stealing customer passwords, payment details, or credentials — and your brand takes the reputational hit. Google and Yahoo now require DMARC for bulk senders, meaning stores without it face deliverability problems: legitimate order confirmations, shipping notices, and marketing emails are more likely to land in spam or be rejected entirely. This directly harms revenue through lost transactional emails and undelivered promotions. OWASP classifies this under A05:2021 Security Misconfiguration because a missing DMARC record is a straightforward, avoidable configuration gap that exposes your customers and business to serious harm.

See the complete Missing dmarc guide for every platform and the full background.