What is a DMARC record and how do I add one?
DMARC is a DNS policy that tells mailbox providers what to do when a message claiming to be from your domain fails authentication. With no DMARC record, a receiver has no domain-level instruction to follow, and forged mail that says it is from you is more likely to reach inboxes.
Why this matters
DMARC is built on two older standards, SPF and DKIM, and it adds a published policy on top of them. It is stored as a TXT record at the name _dmarc followed by your domain, for example _dmarc.example.com, and RFC 7489 defines its tag-value syntax. The central tag is p, the requested policy, and it takes one of three values: none, which asks receivers to deliver the mail as usual but send reports; quarantine, which asks them to treat failing mail as suspicious; and reject, which asks them to refuse it outright. A typical record reads v=DMARC1; p=reject; pct=100; rua=mailto:reports@example.com. The pct tag sets the percentage of failing mail the policy applies to and defaults to 100, and the rua tag names where aggregate reports should be sent. Google’s sender guidelines are a strong reason to act: since February 2024, bulk senders who send 5,000 or more messages a day to Gmail addresses must set up DMARC, and the required policy may initially be none. Without any DMARC record, a receiving provider has nothing to apply, so it falls back to its own judgement and spoofed mail passes more often.
How to fix it
Publish a TXT record at _dmarc.yourdomain. Start at p=none so you receive aggregate reports without risking legitimate mail, watch those reports long enough to find and fix any sender that fails SPF or DKIM, then move the policy to quarantine and finally to reject. Only one DMARC record should exist at that name, and it should reference a mailbox you actually monitor, because the reports are how you learn which senders to fix before you tighten the policy.
# Step 1: monitor only, and collect reports
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
# Step 2: quarantine failing mail
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"
# Step 3: reject failing mail
_dmarc.example.com TXT "v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@example.com"How to verify the fix
Query the TXT record for _dmarc.example.com and read the p tag back. Use nslookup on Windows or dig elsewhere; both read the same public DNS answer a receiving mail server would see. Confirm the policy value is the one you intended and that the record appears once, with no duplicate.
nslookup -type=TXT _dmarc.example.com
# or, where available:
dig +short TXT _dmarc.example.comAutomated check
The Auditor does not read DNS records. Its scan looks at the page it is given and that page’s response headers, so it cannot see an SPF, DKIM, or DMARC record, and it will not warn you that this one is missing. Check the record with the commands above, then use the scan for the web-facing issues it does cover.
Scan your app free →