No DMARC record found
There is no DMARC policy at _dmarc for this domain.
Check your own domain
What causes this
DMARC is a TXT record at _dmarc.yourdomain.com. It does two things: it tells receivers what to do with mail that fails both SPF and DKIM alignment, and it asks them to send you aggregate reports about who is sending mail as your domain. Without it, receivers have no instruction from you and you have no visibility into how your domain is being used. Google, Yahoo and Microsoft all require bulk senders to publish at least p=none.
What it breaks
Nobody is told what to do with forged mail claiming to be your domain, and you receive no reports showing which systems send on your behalf. Anyone can send mail that appears to come from your domain without a policy standing in the way.
How to fix it
Publish a monitoring-only DMARC record first, then tighten it once the reports are clean.
- Create a TXT record at _dmarc.yourdomain.com.
- Start with p=none and a reporting address so you collect data without affecting delivery.
- Read the aggregate reports for two to four weeks and confirm every legitimate sender passes SPF or DKIM with alignment.
- Move to p=quarantine, then to p=reject once the reports show no legitimate mail would be affected.
Example record
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Replace the reporting address with a mailbox you actually monitor, or a DMARC reporting service.
Specification: RFC 7489 — DMARC
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.
- More than one DMARC record publishedMultiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.