HighAuthentication · usually high
DMARC record contains a syntax error
A tag in the DMARC record is malformed, which can invalidate the whole policy.
Check your own domain
What causes this
A DMARC record is a list of tag=value pairs separated by semicolons, and it must start with v=DMARC1 followed by a policy tag. Receivers that cannot parse the record generally discard it. Common causes are a missing semicolon, an unknown tag name, a policy value other than none, quarantine or reject, or a reporting address written without the mailto: prefix.
What it breaks
The policy may be ignored altogether, which silently removes the enforcement you believe is in place.
How to fix it
Fix the malformed tag so the record parses.
- Check the flagged tag against the DMARC specification.
- Confirm the record begins with v=DMARC1 and that p= is the second tag.
- Confirm every rua/ruf address is written as mailto:someone@example.com.
- Republish and re-check.
Specification: RFC 7489 — DMARC
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- More than one DMARC record publishedMultiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.