Check ID: zone_record_dmarc_exists
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: email-security
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for DMARC (Domain-based Message Authentication, Reporting, and Conformance) records by checking if a TXT record exists at _dmarc subdomain with an enforcement policy (p=reject or p=quarantine) to actively block or quarantine spoofed emails.

​
Risk

Without DMARC or with p=none, there is no active protection against email spoofing. Attackers can spoof emails for phishing campaigns to steal credentials. Domain reputation is damaged by spoofed emails. The p=none policy only generates reports but does not block or quarantine spoofed emails.

​
Recommendation

Implement DMARC with an enforcement policy (p=reject or p=quarantine).
  • p=reject: receiving servers should reject emails that fail authentication
  • p=quarantine: receiving servers should send suspicious emails to spam folder
  • p=none: only monitoring, provides no protection (will fail this check)
  • Ensure SPF and DKIM are properly configured before enabling enforcement
  • Configure rua to receive aggregate reports on authentication results
  • Use pct parameter to gradually roll out enforcement (e.g., pct=10 for 10% of emails)

​
Remediation

# Create DMARC record with enforcement policy
resource "cloudflare_record" "dmarc" {
  zone_id = "<ZONE_ID>"
  name    = "_dmarc"
  type    = "TXT"
  content = "v=DMARC1; p=reject; rua=mailto:[email protected]" # Use p=reject or p=quarantine for enforcement
  ttl     = 3600
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_record_dmarc_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks