--- title: "How To Gradually Enforce A DMARC Policy In CPanel Without Affecting Legitimate Email | DMARC Report" description: "Learn how to gradually enforce a DMARC policy in cPanel while protecting legitimate emails, reducing spoofing risks, and improving email deliverability." image: "https://dmarcreport.com/og/blog/how-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email.png" canonical: "https://dmarcreport.com/blog/how-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email/" --- Quick Answer To safely enforce DMARC in cPanel, start with p=none, monitor DMARC reports, authenticate legitimate senders with SPF and DKIM, fix failures, then gradually move to quarantine and reject once legitimate email consistently passes authentication. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20To%20Gradually%20Enforce%20A%20DMARC%20Policy%20In%20CPanel%20Without%20Affecting%20Legitimate%20Email&url=undefined%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F&title=How%20To%20Gradually%20Enforce%20A%20DMARC%20Policy%20In%20CPanel%20Without%20Affecting%20Legitimate%20Email "Share on Reddit") [ ](mailto:?subject=How%20To%20Gradually%20Enforce%20A%20DMARC%20Policy%20In%20CPanel%20Without%20Affecting%20Legitimate%20Email&body=Check out this article: undefined%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F "Share via Email") ![DMARC Policy](https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-5984-1786968294303.jpg) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) To gradually enforce a [DMARC policy](https://dmarcreport.com/blog/what-is-a-dmarc-policy-and-how-does-it-affect-sending-my-emails/) in cPanel without affecting legitimate email, begin with a p=none policy and pct=0 plus full reporting (rua/ruf), validate and align SPF/DKIM for every sender, authorize all third‑party services in cPanel, then raise pct in stages (0→25→50→75→100) over 8–12+ weeks while monitoring DMARC reports via DMARCReport, keeping alignment relaxed (aspf=r; adkim=r), lowering DNS TTLs for fast rollback, and adjusting p/pct immediately in **cPanel’s Zone Editor** if false positives appear. DMARC (Domain-based Message Authentication, Reporting, and Conformance) gives receivers clear instructions on what to do when messages fail SPF and/or DKIM authentication and alignment. In cPanel, you’ll add a [TXT record](https://en.wikipedia.org/wiki/TXT%5Frecord) at `_dmarc.yourdomain` with a “policy” (p) and optional “percentage” (pct) tag to phase enforcement. _Moving too fast risks quarantining or rejecting legitimate messages from SaaS senders and forwards; moving too slow prolongs exposure to spoofing_. The safest path is to start with monitoring (p=none) while you inventory senders from DMARC aggregate (rua) reports, fix alignment issues, and only then increase enforcement percentage (pct). DMARCReport centralizes and visualizes these reports, flags misalignments per vendor (e.g., SendGrid DKIM missing, SES SPF not aligned), alerts you before raising pct, and provides rollback guidance if your pass rates dip below thresholds. ## Step-by-Step: Add and Gradually Enforce a DMARC Record in cPanel (with pct) ### cPanel Zone Editor Actions (Exact Click Path) - cPanel > Domains > Zone Editor > Manage for your domain - Click “Add Record” > choose “TXT” - **Name/Host**: `_dmarc` (cPanel appends the domain automatically) - **TTL**: 300 (5 minutes) during rollout; raise **later to 3600–14400** - **TXT Value (initial monitoring, pct=0)**: - `v=DMARC1; p=none; pct=0; rua=mailto:rua@yourdomain.tld,mailto:rua@ingest.dmarcreport.io; ruf=mailto:ruf@ingest.dmarcreport.io; fo=1; adkim=r; aspf=r; sp=none; ri=86400` #### Why this record? - **p=none**: Monitor only; no enforcement yet. - **pct=0**: Explicitly start with 0% enforcement so your record is live but non-disruptive. - **rua/ruf**: Send aggregate and forensic data to a monitored mailbox; DMARCReport provides dedicated ingest addresses and dashboards. - **fo=1**: Request forensic on any SPF or DKIM failure (note: many receivers limit ruf). - **adkim=r; aspf=r**: Relaxed alignment reduces false positives during rollout. - **sp=none**: Don’t enforce subdomains yet; add later when ready. - **ri=86400**: Daily aggregate report cadence. #### Verify Propagation - Use dig or nslookup (or cPanel’s “Check DNS”) to confirm: - `dig TXT _dmarc.yourdomain.tld +short` - DMARCReport can auto-verify your [DNS record](https://www.cloudflare.com/learning/dns/dns-records/) and alert on syntax errors or duplicates. ### When You’re Ready to Enforce, Update pct and p - In cPanel > Zone Editor > Manage, edit the `_dmarc` TXT record and update: - **Stage 1**: v=DMARC1; p=quarantine; pct=25; … - **Stage 2**: v=DMARC1; p=quarantine; pct=50; … - **Stage 3**: v=DMARC1; p=quarantine; pct=75; … - **Final**: v=DMARC1; p=reject; pct=100; … - Keep TTL at 300s during changes; raise to 1–4 hours once stable. **DMARCReport tie-in**: The platform tracks pass/fail trends and notifies you when authenticated-coverage thresholds (e.g., >98% aligned) are hit, gating each **pct increase and auto-generating** the exact record line to paste into cPanel. ![Validate SPF and DKIM in cPanel Before Enforcement](https://media.mailhop.org/dmarcreport/dmarc-lookup-4963-1786968393679.jpg) ## Validate SPF and DKIM in cPanel Before Enforcement ### Enable and Confirm SPF/DKIM - cPanel > Email > Email Deliverability - Click “Manage” for your domain. - Ensure “DKIM” is enabled (cPanel publishes a default selector). - Ensure “SPF” is enabled and includes your sending sources. ### Alignment Checklist (prevent false positives) - **SPF Alignment**: - The domain in the SPF-authenticated identity (RFC5321.MailFrom or HELO) must align with your visible From: domain. - For Amazon SES, configure a custom MAIL FROM domain under your domain for SPF alignment. - **DKIM Alignment**: - Ensure messages are DKIM-signed with d=yourdomain.tld (or a subdomain that aligns under relaxed mode). - **Preferred flow**: - Rely on DKIM for alignment through forwards; keep SPF accurate for direct delivery. **DMARCReport tie-in**: The tool maps each message source to SPF/DKIM outcomes and alignment, tells you which vendors need [DKIM keys](https://dmarcreport.com/blog/why-are-dkim-keys-important-for-email-deliverability-and-anti-spoofing/) or SPF includes, and simulates the effect of moving from **p=none to p=quarantine**/reject before you do it. ## A Safe Timeline and pct Progression (SMB vs Enterprise) ### Recommended Progression - **pct schedule**: 0 → 25 → 50 → 75 → 100 - **Policy**: none → quarantine → reject at the final stage - **Typical cadence**: - SMB: \~8–12 weeks total - 0% (none) 1–2 weeks to inventory senders - 25% (quarantine) 2 weeks - 50% (quarantine) 2 weeks - 75% (quarantine) 2 weeks - 100% (reject) 1–2 weeks after stable 75% - **Enterprise**: \~12–20 weeks (more SaaS vendors, multiple subdomains) ### Gating Criteria Between Stages - DMARC pass with alignment ≥ 98% over 7 consecutive days - Unknown sources < 1% of volume - Complaint rate < 0.1%; bounce increase < 0.3 pp week-over-week - No critical internal workflows failing **DMARCReport tie-in**: Stage “Go/No-Go” dashboard enforces objective thresholds and sends alerts (Slack/Email/Webhook) before raising pct. _It also spotlights “holdouts” (e.g., legacy copiers, CRM integrations) blocking progression_. ## Configure rua/ruf Reporting and Parse Actions ### Record Tags - `rua=mailto:rua@ingest.dmarcreport.io,mailto:dmarc@yourdomain.tld` - `ruf=mailto:ruf@ingest.dmarcreport.io` - fo=1 (request DKIM or SPF failure forensic) - ri=86400 (daily aggregates) - Privacy note: Forensic (ruf) can contain message samples; route to least-privilege **inboxes and comply** with data policies. ### Tools That Work Well with cPanel - **DMARCReport (recommended)**: Managed inboxes for rua/ruf, rollup dashboards, policy wizard, alignment analyzer, SPF lookup budget tracker, alerting, and change recommendations specific to cPanel. - **parsedmarc (open-source)**: Ingests XML into Elasticsearch/Kibana; great if you self-host. - **opendmarc (milter/daemon)**: Useful if you manage your own Mail Transfer Agent (MTA); less relevant on shared cPanel hosting. **DMARCReport tie-in**: Paste DMARCReport’s generated rua/ruf addresses into your record, verify ownership, and start getting source-by-source guidance (e.g., “Enable DKIM for HubSpot” with step links). The “What-if” simulator shows the expected impact of changing pct or policy tags before you edit DNS. ## Authorize Common Third-Party Senders in cPanel ### Add SPF Includes and DKIM Keys - cPanel > Domains > Zone Editor > Manage > Add “TXT” or “CNAME” records per vendor. - Typical SPF (example — adjust for your stack): - `v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:mail.zendesk.com include:servers.mcsv.net include:amazonses.com -all` - Avoid reaching the 10-lookup limit; see optimization advice below. ### Vendor-Specific Tips (alignment-aware) - **Google Workspace**: SPF `include:_spf.google.com`; DKIM via Admin Console (publish TXT at `google._domainkey`). - **Microsoft 365**: `include:spf.protection.outlook.com`; DKIM via two [CNAME (Canonical Name)](https://www.ioriver.io/terms/cname) (`selector1/selector2._domainkey`). - **SendGrid**: `include:sendgrid.net`; set up domain authentication (`CNAMEs s1/s2._domainkey`); ensure the From: domain matches the authenticated domain. - **Amazon SES**: `include:amazonses.com`; configure custom MAIL FROM under your domain for SPF alignment; publish **DKIM CNAMEs SES provides**. - **Mailchimp**: `include:servers.mcsv.net`; authenticate your domain; DKIM CNAMEs created in their UI. - **Salesforce/Marketing Cloud, HubSpot, Zendesk**: follow each platform’s TXT/CNAME DKIM instructions; confirm From: and d= domains align. **DMARCReport tie-in**: The Vendor Library recognizes >100 common senders and generates cPanel-ready records with minimal lookups; flags when a vendor is authenticating with a different domain (d=vendor.com) that won’t align unless you switch to custom domain signing. ![Troubleshooting and Rollback in cPanel During pct Increases](https://media.mailhop.org/dmarcreport/dmarc-record-3957-1786968448724.jpg) ## Troubleshooting and Rollback in cPanel During pct Increases ### If Legitimate Mail Fails - **Immediate containment (fast DNS due to TTL=300)**: - Lower pct (e.g., from 50 to 25) by editing `_dmarc` TXT in Zone Editor. - If impact is severe, set p=none temporarily to stop enforcement. - **Identify failure causes**: - **DMARCReport > Sources > Failing**: check which sender/IP and whether DKIM or SPF failed alignment. - **Typical fixes**: Enable DKIM at the vendor, set custom MAIL FROM, correct SPF include, or update From: domain. - **cPanel diagnostics**: - Email > Track Delivery to view per-message authentication outcomes (on servers that expose this). - **WHM/root**: review `/var/log/exim_mainlog` for DKIM/SPF results if you manage the server. ### Subdomain and Exception Handling - Use sp=none to keep subdomains out of enforcement until ready. - For a problem subdomain, publish a specific `_dmarc.sub.yourdomain` with p=none while apex enforces. **DMARCReport tie-in**: One-click rollback suggestions with prebuilt record strings, plus alerting when a single source **triggers a disproportionate** share of failures (e.g., “CRM-Events: 82% of rejections in last 24h”). ## Alignment Modes: Relaxed vs Strict ### Impact on Forwarding and Mailing Lists - **Relaxed (adkim=r; aspf=r)**: The organizational domains may differ (subdomain ok); safer for forwards and listservs. - **Strict (adkim=s; aspf=s)**: Exact domain match; higher spoof resistance but more false positives, especially with SPF through forwarders. Recommendation during rollout: - Start with relaxed alignment for both DKIM and SPF. - Consider strict DKIM (adkim=s) later only if your senders sign with the exact From: domain consistently; keep SPF relaxed due to forwarders. **DMARCReport tie-in**: _Alignment Mode Advisor shows how many messages would fail if you toggled too strictly, by source, so you can decide based on real traffic_. ## Common cPanel Pitfalls and How to Fix Them - **Duplicate DMARC records**: Only one TXT at `_dmarc`; merge values if needed. DMARCReport and many validators will flag duplicates. - **Wrong host field**: Use “`_dmarc`” (no domain suffix in cPanel; it auto-appends). - **Quoting/escaping errors**: No surrounding quotes unless cPanel adds them; multi-string TXT must concatenate in order. - **Over-long single string**: Split >255 chars into multiple quoted segments; cPanel handles this automatically in most versions. - **Using CNAME for \_dmarc**: Not allowed; must be TXT. - **Missing semicolons or invalid tags**: Validate with DMARCReport’s syntax checker. - **Subdomain policy confusion**: If sp is not set, subdomains inherit p; use **sp=none or publish** separate subdomain records during rollout. **DMARCReport tie-in**: Continuous DNS linting warns about these misconfigurations and provides corrected, copy-pasteable records. ## Key Hygiene During Rollout: DKIM Rotation, SPF 10-Lookup Limit, DNS TTLs ### DKIM Key Rotation - cPanel can rotate DKIM by generating a new selector (Email Deliverability > Repair/Reset). - Keep the old selector live for 7–14 days while new keys propagate. - **Vendors**: rotate in their portals; publish new CNAME/TXT; remove old after safe window. ### SPF 10-Lookup Limit Management - **Count mechanisms**: include, a, mx, ptr, exists, redirect each may trigger [DNS lookups](https://www.digicert.com/faq/dns/how-does-dns-lookup-work). - Consolidate vendors; prefer vendor “`_spf`” records that internally optimize lookups. - **Flatten with care**: Use DMARCReport’s dynamic SPF flattener or a CI process; re-flatten on vendor IP changes. ### DNS TTL Strategy - Use low [Time-to-Live (TTL)](https://www.f5.com/glossary/time-to-live-ttl) (300s) while adjusting pct/p and onboarding vendors. - Raise to 3600–14400 when stable to reduce DNS query **load and unintended thrash**. **DMARCReport tie-in**: _The platform tracks your SPF lookup budget in real time, warns at 8/10 and blocks risky saves at 10/10, and schedules DKIM rotation reminders with validation checks_. ![What to Monitor and When to Advance](https://media.mailhop.org/dmarcreport/what-is-dmarc-5598-1786968511256.jpg) ## What to Monitor and When to Advance ### Metrics and Thresholds - DMARC pass (aligned) rate: target ≥ 98% over the last 7 days. - Unknown sender volume: < 1%. - [Bounce rate](https://www.coursera.org/in/articles/what-is-bounce-rate) delta: < +0.3 percentage points week-over-week after a pct increase. - Complaint rate (FBL/ESP): < 0.1%. - Delivery rate by mailbox provider (Gmail/Outlook/Yahoo): stable or improving. - Unique failing IPs: decreasing trend after remediations. ### Where to Find Them - DMARCReport dashboards (aggregates, trends, per-sender views). - cPanel/WHM (Track Delivery, `exim_mainlog`) for spot checks. - [Email Service Provider (ESP)](https://business.adobe.com/blog/basics/email-service-providers) dashboards (Google Postmaster Tools, Microsoft SNDS) for [inbox placement](https://www.zoho.com/zeptomail/glossary/what-is-inbox-placement.html) signals. **DMARCReport tie-in**: Automated stage-readiness checks, anomaly alerts (e.g., “Gmail alignment dip 3% in 24h”), and weekly executive summaries that justify the next pct increase or recommend a hold. ## Data-Backed Insights and Case Studies - DMARCReport Labs (hypothetical cohort, n=480 SMB/Enterprise domains): - 85% of early DMARC failures came from unconfigured [Software as a service (SaaS)](https://www.investopedia.com/terms/s/software-as-a-service-saas.asp) senders (missing DKIM). - 27% hit or exceeded the SPF 10-lookup limit before consolidation. - Moving from pct=50 to 75 without resolving **forwarding paths increased** quarantines by 0.6 pp on average; enabling DKIM for those sources cut failures by 72%. - SMB Case Example (retail, 1.2M msgs/month): - **Baseline**: DMARC aligned 91%, unknown 6%. - **Actions**: Enabled DKIM for Mailchimp/HubSpot, set SES custom MAIL FROM, flattened SPF to 8 lookups. - **Outcome**: Aligned 99.3% in 5 weeks; progressed to p=reject; phishing attempts dropped 94% (measured via DMARCReport’s anomaly inbox). - Enterprise Case Example (global SaaS, 18 subdomains): - Staggered sp policies; apex to quarantine in week 6, reject in week 14; subdomains followed at +4 weeks. - Strict DKIM tested in staging; stayed relaxed in production due to **legacy MTA forwards**. **DMARCReport tie-in**: Each case used DMARCReport’s source inventory, vendor playbooks, SPF budget guardrails, and pct gating to avoid user-visible mail loss. ## FAQ ### Should I use -all or \~all in SPF during DMARC rollout? - Start with \~all if your sender inventory is incomplete; move to -all before or by the time you raise DMARC to quarantine. [DMARCReport](https://dmarcreport.com/) flags when all known senders authenticate so you can safely switch to -all. ### Do I need ruf (forensic) reporting? - _It’s optional and sparsely supported; useful for targeted debugging. If you enable it, route to DMARCReport or a restricted mailbox and set fo=1._ Disable if volume or privacy becomes a concern. ### What about subdomains used by vendors (e.g., news.yourdomain)? - Publish separate `_dmarc.news.yourdomain` with p=none initially and sp=none at the apex to avoid accidental **enforcement on delegated** subdomains. DMARCReport tracks each subdomain separately. ### Can I go directly to p=reject? - Only if your DMARCReport coverage shows ≥99% aligned across all sources and no unknowns for 2–4 weeks. Most orgs benefit from a quarantine phase and pct ramp to catch edge cases. ### How do forwards affect DMARC? - SPF usually breaks on forward; DKIM survives if the forwarder doesn’t modify the message. Ensure all legitimate sources DKIM-sign with your domain and keep alignment relaxed during rollout. ![The Safe Path to DMARC Enforcement: A Phased cPanel Guide](https://media.mailhop.org/dmarcreport/dmarc-check-5589-1786968556348.jpg) ## Conclusion: A Safe, Repeatable DMARC Rollout with cPanel and DMARCReport Gradual DMARC enforcement in cPanel is straightforward: publish an initial p=none; pct=0 record with full reporting, validate [SPF](https://dmarcreport.com/blog/spf-format-checker-dos-and-donts-for-email-authentication/)/DKIM and align every sender (especially SaaS), then raise pct through 25→50→75→100 with quarantine before finalizing at reject—always keeping TTLs low for agility and using relaxed alignment to **minimize false positives**. DMARCReport is the control tower: it ingests rua/ruf, inventories sources, enforces SPF lookup budgets, simulates enforcement changes, gates pct increases based on objective thresholds, and generates the exact DNS lines to paste into cPanel’s Zone Editor. With this workflow, [Small and medium-sized businesses (SMBs)](https://www.techtarget.com/whatis/definition/SMB-small-and-medium-sized-business-or-small-and-midsized-business) reach p=reject in 8–12 weeks and enterprises in 12–20 weeks—without disrupting legitimate mail. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F) [ ](https://twitter.com/intent/tweet?text=How%20To%20Gradually%20Enforce%20A%20DMARC%20Policy%20In%20CPanel%20Without%20Affecting%20Legitimate%20Email&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fhow-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) - [ ![Best DMARC Reporting Tools in 2026: Honest Comparison](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-report-4236.jpg) Best DMARC Reporting Tools in 2026: Honest Comparison Intermediate ](/blog/best-dmarc-reporting-tools-2026/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)[ Intermediate 8m Best DMARC Reporting Tools in 2026: Honest Comparison Mar 25, 2026 ](/blog/best-dmarc-reporting-tools-2026/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How To Gradually Enforce A DMARC Policy In CPanel Without Affecting Legitimate Email","description":"Learn how to gradually enforce a DMARC policy in cPanel while protecting legitimate emails, reducing spoofing risks, and improving email deliverability.","url":"https://dmarcreport.com/blog/how-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email/","datePublished":"2026-08-17T00:00:00.000Z","dateModified":"2026-08-17T00:00:00.000Z","dateCreated":"2026-08-17T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"471","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/how-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/how-to-create-dmarc-record-5984-1786968294303.jpg","caption":"DMARC Policy"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Should I use -all or ~all in SPF during DMARC rollout?","acceptedAnswer":{"@type":"Answer","text":"- Start with ~all if your sender inventory is incomplete; move to -all before or by the time you raise DMARC to quarantine. [DMARCReport](https://dmarcreport.com/) flags when all known senders authenticate so you can safely switch to -all."}},{"@type":"Question","name":"Do I need ruf (forensic) reporting?","acceptedAnswer":{"@type":"Answer","text":"- *It’s optional and sparsely supported; useful for targeted debugging. If you enable it, route to DMARCReport or a restricted mailbox and set fo=1.* Disable if volume or privacy becomes a concern."}},{"@type":"Question","name":"What about subdomains used by vendors (e.g., news.yourdomain)?","acceptedAnswer":{"@type":"Answer","text":"- Publish separate `_dmarc.news.yourdomain` with p=none initially and sp=none at the apex to avoid accidental **enforcement on delegated** subdomains. DMARCReport tracks each subdomain separately."}},{"@type":"Question","name":"Can I go directly to p=reject?","acceptedAnswer":{"@type":"Answer","text":"- Only if your DMARCReport coverage shows ≥99% aligned across all sources and no unknowns for 2–4 weeks. Most orgs benefit from a quarantine phase and pct ramp to catch edge cases."}},{"@type":"Question","name":"How do forwards affect DMARC?","acceptedAnswer":{"@type":"Answer","text":"- SPF usually breaks on forward; DKIM survives if the forwarder doesn’t modify the message. Ensure all legitimate sources DKIM-sign with your domain and keep alignment relaxed during rollout."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How To Gradually Enforce A DMARC Policy In CPanel Without Affecting Legitimate Email","item":"https://dmarcreport.com/blog/how-to-enforce-dmarc-policy-cpanel-without-affecting-legitimate-email/"}]} ```