CxO Tools / Deliverability / Email Errors / DMARC

No DMARC Record: Why Your Domain Can Be Spoofed

DMARC (Domain-based Message Authentication, Reporting, and Conformance, RFC 7489) is a DNS TXT record published at `_dmarc.<yourdomain>` that tells receiving mail servers what to do with messages claiming to be from your domain that fail authentication. "No DMARC record" means no valid `v=DMARC1` TXT record exists at that hostname, so there is no published policy for your domain. DMARC works by checking "identifier alignment": the visible From: domain (RFC5322.From) must match the domain validated by SPF (the RFC5321.MailFrom / Return-Path domain, per RFC 7208) and/or the DKIM `d=` signing domain (RFC 6376). Without a DMARC record, receivers still run SPF and DKIM but have no instruction from you about handling failures or spoofed From: addresses.

Why it matters

With no DMARC policy, a spammer can put your exact domain in the From: header, and most receivers will deliver it because you never told them to reject unaligned mail. This enables direct-domain phishing, business email compromise, and brand impersonation against your customers and staff. You also get zero visibility: DMARC's aggregate (rua) reports are what reveal who is sending as your domain, so without a record you are blind to abuse and to your own misconfigured senders. Increasingly, bulk senders (Google, Yahoo, Microsoft) require at least a DMARC record (even p=none) for reliable delivery, so its absence also hurts legitimate deliverability. This is governed by RFC 7489 (DMARC).

Common causes

  • No DMARC record was ever published for the domain.
  • The record is published at the wrong host (e.g. on the root domain or `dmarc.example.com` instead of `_dmarc.example.com`).
  • Syntax error so it is not recognized: the record must begin with `v=DMARC1` and include a `p=` tag, or receivers ignore it.
  • Two or more DMARC TXT records exist at `_dmarc`, per RFC 7489 that is treated as no valid record (policy discovery terminates and DMARC is not applied).
  • No record exists on the organizational domain at all. Note: an organizational-domain record already covers its subdomains by default (via `p=`, or `sp=` if set), so a subdomain does not need its own record, but publishing a broken/empty `_dmarc` record on the subdomain, or recently deleting the org record / not yet propagating it, can leave you with no valid policy.
  • SPF and DKIM were set up but the admin stopped before adding DMARC, assuming those two were enough.

How to fix No DMARC Record

  1. Get SPF (RFC 7208) and DKIM (RFC 6376) working and aligned FIRST, DMARC only passes when at least one of them authenticates AND aligns with the From: domain. Confirm every legitimate sender (Google Workspace, M365, marketing/CRM tools) is covered.
  2. Publish a single TXT record at `_dmarc.example.com` starting with `v=DMARC1; p=none;` and add a reporting address, e.g. `v=DMARC1; p=none; rua=mailto:[email protected]; fo=1`. Start at `p=none` so nothing is blocked while you observe.
  3. Wait 24-72 hours, then read the aggregate (rua) XML reports (use a DMARC report analyzer). Identify every source sending as your domain and whether it passes SPF/DKIM alignment.
  4. Fix each legitimate sender that fails alignment: enable DKIM signing with your domain, or use a custom Return-Path/subdomain so the SPF-authenticated (RFC5321.MailFrom) domain aligns with your From: domain. Do not move on until all real mail authenticates.
  5. Tighten the policy in stages: move to `p=quarantine` (optionally with `pct=` to phase it, e.g. `pct=25`), monitor reports, then to `p=reject` once only unauthorized mail is failing. Add `sp=reject` only if you want a stricter policy for subdomains than the org policy (subdomains already inherit `p=` by default), and `adkim=s`/`aspf=s` only if you need strict alignment.
  6. Verify exactly ONE valid record exists and syntax is correct: `dig +short TXT _dmarc.example.com` should return a single string beginning `v=DMARC1`. Remove any duplicate DMARC TXT records.
DMARC Record Generator

Frequently asked questions

Do I need SPF and DKIM before adding DMARC?

Yes. DMARC passes only when SPF or DKIM authenticates and the authenticated domain aligns with the visible From: domain. Publishing DMARC without working, aligned SPF/DKIM can cause your own mail to fail once you enforce a policy, so set those up first and start at p=none.

What policy should I start with?

Always start with `p=none`. It changes nothing about delivery but turns on aggregate reporting so you can see every sender using your domain. Only move to quarantine and then reject after the reports confirm all legitimate mail is authenticating and aligning.

Where exactly does the record go?

In DNS as a TXT record at the hostname `_dmarc.<yourdomain>` (for example `_dmarc.example.com`), not on the root domain and not as a CNAME to a random host. The value must start with `v=DMARC1` and contain a `p=` tag. Subdomains inherit this record automatically, so you do not need a separate one per subdomain.

Does p=none actually protect me from spoofing?

No. p=none is monitor-only, it gives you reports but tells receivers to take no action on failures. Real anti-spoofing protection only kicks in at `p=quarantine` or `p=reject`, which is why p=none is a starting point, not the destination.

Related

Mail Health Report SuperCheck SPF PermError SPF Softfail (~all) Multiple SPF Records DMARC p=none