highSeverity: highRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.DNS · TXTWhere it livesImplementationThis fix is applied in: DNS · TXT. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+20 posture+20 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

DMARC: enforce SPF + DKIM and lock spoofing out

Monitor, then quarantine, then reject, the path to an un-spoofable domain

The threat

SPF and DKIM publish how your mail should look. DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. is the instruction that tells receivers what to do when a message fails, and where to send you reports. With no DMARC (or DMARC stuck on p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes.), failing mail still lands in inboxes. Spoofers walk right through.

The exact fix

DMARC lives at a dedicated host and graduates through three policies. Use exactly one _dmarc record.

Stage 1, Monitor (start here, day one)

FieldValue
TypeTXT
Name_dmarc (→ _dmarc.yourdomain.com, not @)
Valuev=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
TTL3600

p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes. changes nothing about delivery, it just starts the aggregate reports flowing to rua=, so you can confirm your legitimate mail passes. Make sure that inbox is real and monitored.

Stage 2, Quarantine (after SPFSPFEmail authSender Policy Framework: a DNS record listing which mail servers are allowed to send email as your domain, so spoofed senders get flagged. + DKIMDKIMEmail authDomainKeys Identified Mail: a cryptographic signature added to your outgoing email and verified against a public key in your DNS. Unlike SPF, it survives forwarding. verified)

Once DKIM is confirmed signing, tighten the policy. If your DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. panel has no “edit,” delete the p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes. record and create a new one (a brief gap is harmless), never run two _dmarc records at once, or receivers treat it as none:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; fo=1; pct=100

Failing mail now goes to spam instead of the inbox.

Stage 3, Reject (the gold standard, ~1 week later)

After a week of clean aggregate reports confirming real mail passes:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; fo=1; pct=100

Spoofed mail is now refused outright.

Name is _dmarc, not @. At the apex it publishes where no receiver looks. And there must be exactly one _dmarc TXT record.

Verify it

dig +short TXT _dmarc.yourdomain.com

Confirm a single record showing your current policy (p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. or p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes.).

Proof

On dev3lop.com, moving _dmarc from p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes. to p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. cleared the final open finding and pushed posture to a perfect 100, overtaking the field to land #1 of 353 scanned sites, the single cleanest domain in the fleet.