How to fix missing dmarc on WooCommerce

Steps for WooCommerce

1. WooCommerce runs on WordPress and does not manage DNS. Log in to your hosting provider's control panel (cPanel, Plesk, or a standalone DNS dashboard like Cloudflare).
2. In cPanel: navigate to Domains → Zone Editor → click 'Manage' next to your domain → Add Record → Type: TXT, Name: _dmarc, TTL: 3600, Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com → Save.
3. Ensure your outgoing WordPress email (via WP Mail SMTP or similar plugin) is authenticated with SPF and DKIM at your mail provider (e.g. SendGrid, Mailgun, Google Workspace) before enforcing a strict DMARC policy.
4. Install a plugin like 'WP Mail SMTP' (Settings → WP Mail SMTP → Setup Wizard) to route mail through an authenticated SMTP provider that supports DKIM, then publish DMARC.

What is missing dmarc?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a free email security standard that works alongside SPF and DKIM. You publish a single DNS TXT record at a special subdomain (_dmarc.yourdomain.com) that tells the world's mail servers what to do when someone sends an email pretending to be from your domain — for example, whether to let it through, quarantine it to spam, or reject it outright. Without this record, anyone on the internet can spoof your brand's email address and there is nothing in place to stop it or report it to you.

Without a DMARC record, criminals can send phishing emails that appear to come from your store's domain — stealing customer passwords, payment details, or credentials — and your brand takes the reputational hit. Google and Yahoo now require DMARC for bulk senders, meaning stores without it face deliverability problems: legitimate order confirmations, shipping notices, and marketing emails are more likely to land in spam or be rejected entirely. This directly harms revenue through lost transactional emails and undelivered promotions. OWASP classifies this under A05:2021 Security Misconfiguration because a missing DMARC record is a straightforward, avoidable configuration gap that exposes your customers and business to serious harm.

See the complete Missing dmarc guide for every platform and the full background.