Enforcing Inbound DMARC Checks on cPanel & Strengthening Email Security

Publishing a strict DMARC record protects your domain at Gmail, Outlook and other providers that enforce it. It does not, by itself, stop a forged message "from" your own domain arriving in your own mailbox: that depends on whether the receiving server, your server, checks DMARC on incoming mail. This guide explains the difference, what our shared hosting does with incoming mail, and how to enforce inbound checks on a mail server you run yourself.

1. Publishing DMARC versus enforcing it

The three records work together:

• SPF lists the servers allowed to send mail for your domain.
• DKIM signs each message with a key published in your DNS.
• DMARC requires SPF or DKIM to pass for the domain in the visible From address, and tells receivers what to do when neither does: none, quarantine or reject.

Your DMARC record is only an instruction. Each receiving mail server decides whether to follow it. Large mailbox providers do. A small mail server only does if it has been set up to verify DMARC on incoming mail.

2. Why forged "internal" mail still gets through

A phishing message claiming to be from [email protected] and sent to [email protected] looks like internal mail. Three things let it through:

• The receiving server doesn't verify DMARC. Without that step, a p=reject record has no effect on mail your own server receives.
• Envelope sender and header From differ. Servers check SPF against the hidden envelope sender. An attacker can use their own envelope sender, pass SPF for their domain, and still show your domain in the From line. Only DMARC ties the two together.
• Forwarding and relays change the sending server, so strict rules can also catch genuine forwarded mail. That is why every rule below needs testing.

3. What happens to incoming mail on Domain India shared hosting

We checked our shared mail servers on 24 September 2026. The Exim mail server on our cPanel and DirectAdmin servers is not built with DMARC verification, so incoming mail is not rejected because it fails the sender's DMARC policy. On our cPanel servers, incoming mail passes through:

• greylisting, which delays mail from unknown senders so many spam tools give up;
• Spamhaus and SpamCop blocklists, which refuse mail from known spam sources;
• SpamAssassin spam scoring, which you switch on and tune for your own account with Spam Filters.

The mail server's configuration is shared by every account on the server, so it can't be changed on shared hosting. What you can do:

4. Enforcing inbound checks on your own server

This section applies only to a mail server you run yourself, such as your own VPS or dedicated server. It does not apply to Domain India shared hosting.

First, check whether your Exim build can verify DMARC:

exim -bV | grep -i dmarc

If DMARC doesn't appear in the "Support for" line, Exim can't check DMARC itself, and you have two practical options.

Option A: refuse unauthenticated mail that uses your domain as the sender

If all of your genuine mail is sent by users who log in to your server, you can refuse messages that arrive from outside with one of your domains as the envelope sender. In Exim, add this to the RCPT ACL:

deny
  !authenticated = *
  !hosts         = +relay_hosts
  sender_domains = +local_domains
  message        = Unauthenticated mail using a local sender domain is refused

On a cPanel server you manage, custom ACL lines go in WHM's Exim Configuration Manager, in the Advanced Editor. Limits of this rule:

• It checks the envelope sender only, so it stops the crudest forgeries, not a forged From line with an outside envelope.
• It blocks outside services that legitimately send as your domain, such as a newsletter tool, a CRM or Google Workspace, unless you add their servers to relay_hosts or they use their own envelope domain.
• It can break some forwarded mail.

Option B: verify DMARC with a mail filter

A content filter that understands DMARC checks the From domain against SPF and DKIM results and applies the sender's policy. Rspamd has a DMARC module that can add a header to mail failing a quarantine policy and reject mail failing a reject policy; SpamAssassin 4 can score DMARC results. Start in report-only or scoring mode, watch the results for a week or two, and only then reject.

5. Testing and monitoring your own server

Start with a forged test message sent from a machine that isn't your mail server, using the swaks tool:

swaks --to [email protected] --from [email protected] --server mail.yourdomain.com

With option A in place, the server should refuse it at the RCPT stage. Then:

• Send genuine mail from a logged-in mailbox, your website and every outside service you use, and confirm each one still arrives.
• Read the logs. On a cPanel server, refused messages appear in /var/log/exim_mainlog; search for your rule's message text.
• Read your DMARC reports. The aggregate reports from your own record show who is sending as your domain and whether it passes.
• Keep the server updated, including Exim and the spam filter, and review the rules whenever you add or remove a sending service.

6. People are the last filter

• Check the sender's real address, not just the display name, and look for misspelt domains.
• Hover over links before clicking and compare the real destination.
• Confirm unusual requests for payments, passwords or bank changes by phone or in person, never by replying.
• Have one place to report suspicious mail inside your organisation.

7. Email security with Domain India

• Hosting email (cPanel, DirectAdmin, Webuzo): manage your SPF, DKIM and DMARC records in your panel's DNS editor if your domain uses our hosting nameservers, and tune your own spam filter as described above. For the DKIM selector and checks on DirectAdmin, see How to check and manage DKIM in DirectAdmin.
• Business Email: every incoming message is checked for SPF, DKIM and DMARC, and the results are recorded in its headers. Failures raise the spam score, and mail over the threshold is filed in the Junk folder rather than rejected, so you can still recover a genuine message.

The price on the card is a live Domain India list price and excludes 18% GST. For the wider picture, see Email deliverability: SPF, DKIM, DMARC and BIMI.

Ready to lock down your domain's email? Publish your records with Setting up DMARC, look at Business Email, or open a support ticket if spoofed mail keeps reaching your inbox.