Fix Missing DMARC Record on Sender Domain

What's happening

Domain-based Message Authentication, Reporting, and Conformance (DMARC), defined in RFC 7489, is published as a TXT record at _dmarc. and tells receivers what to do when SPF and DKIM both fail to authenticate. It also enables aggregate reporting (rua=) so the domain owner can see who is sending as their domain.

When DMARC is missing, receivers have no policy to enforce. They cannot reject or quarantine spoofed mail with confidence, and you have zero visibility into authentication failures. Phishers can impersonate your domain freely, and you find out via customer reports rather than telemetry.

Google's February 2024 bulk-sender requirements mandate a published DMARC record (at minimum p=none with rua=) for domains sending 5,000+ messages per day to Gmail. Yahoo enforces a similar policy. Failure to publish triggers temporary failures (421 4.7.0) and eventual permanent rejects (5.7.26).

Why it matters

Without DMARC, brand impersonation goes undetected. Attackers register lookalike domains or directly spoof your envelope-from, send phishing to your customers and partners, and you have no aggregate report to surface the activity.

Bulk senders without DMARC fail Gmail and Yahoo enforcement requirements outright. Mail delivery degrades to spam folders within days of high-volume sending, and reputation rebuilds slowly even after DMARC is added.

B2B procurement and security questionnaires routinely require DMARC enforcement (p=quarantine or p=reject). A missing DMARC record is a finding in SOC 2 and ISO 27001 audits and blocks enterprise sales cycles.

Common causes

• Domain owner unaware of DMARC requirement and never published the record.
• DMARC was published for a parent domain but not for active subdomains.
• Record was deleted during a DNS migration.
• Confusion about whether SPF + DKIM alone is sufficient (it is not — DMARC ties them together).
• Concern about p=reject blocking mail led to indefinite postponement of any DMARC publication.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Set up an aggregate report mailbox

   Create a dedicated mailbox like dmarc-reports@example.com or use a service like dmarcian, EasyDMARC, Valimail, or Postmark DMARC Digest. Aggregate reports (rua=) arrive as zipped XML attachments daily from every receiver — you need a parser, not a human, to read them.

2. 2

   Publish a monitoring-only DMARC record

   Add a TXT record at _dmarc.example.com with value v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; fo=1. p=none means "do not enforce, just report" — this is safe and produces no delivery impact while you observe traffic.

3. 3

   Verify publication with dig

   Run dig +short TXT _dmarc.example.com and confirm the record returns. Check Authentication-Results headers on test mail — they should now include dmarc=pass (or fail with a reason). Without DMARC publication, this header line was absent.

4. 4

   Review aggregate reports for two weeks

   Open the parsed reports and identify every source IP and signing domain. Confirm each legitimate sender (your ESP, CRM, marketing tool) has SPF pass + DKIM pass + alignment. Anything failing is either a misconfigured legitimate sender or unauthorized use of your domain.

5. 5

   Move to p=quarantine with pct=10

   Once legitimate sources are clean, change the policy to v=DMARC1; p=quarantine; pct=10; rua=...; fo=1. pct=10 means "apply the policy to 10% of failing mail". Watch for two weeks. If reports show no legitimate-sender impact, raise pct to 50, then 100.

6. 6

   Move to p=reject for full enforcement

   After p=quarantine; pct=100 runs cleanly for two weeks, change to v=DMARC1; p=reject; rua=...; fo=1. This rejects any unauthenticated mail purporting to come from your domain. Brand impersonation defense is now active.

7. 7

   Add subdomain policy

   If subdomains do not send mail or send through different infrastructure, add sp=reject (or sp=none if you intentionally allow subdomains to send unauthenticated). Without sp=, subdomains inherit p= — which may be too strict or too loose for your needs.

Example

; Stage 1 — monitoring only
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; fo=1"

; Stage 2 — soft enforcement, 10% of failing mail
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@example.com; fo=1"

; Stage 3 — full enforcement
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-fail@example.com; fo=1"

Three-stage DMARC rollout from p=none to p=reject.

Related fixes