Missing DMARC Record

Severity: Medium

What does this mean?

Your zone publishes MX records — so it is set up to send and receive mail — but it has no _dmarc TXT record. DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It publishes a policy telling receiving mail servers what to do with messages that fail SPF or DKIM alignment, and it enables aggregate reporting back to you.

Why this is a problem

Without a DMARC record, there is no published policy for receivers to follow when mail fails authentication, so spoofed messages are handled inconsistently or delivered anyway. You also receive no aggregate reports, leaving you without visibility into who is sending mail using your domain.

What you should do

• Publish a _dmarc TXT record for your domain
• Start at p=none with a rua= reporting address so you can observe traffic without affecting delivery
• Once your legitimate mail is aligned, move to p=quarantine or p=reject
• The Email Deliverability tool can propose a p=quarantine record for you