DMARC is a TXT record at _dmarc.yourdomain.com that tells receiving servers what to do with email claiming to be from you that fails SPF or DKIM. Without it, your domain is easier to spoof, and Google requires it from anyone sending more than 5,000 messages a day. Set up SPF and DKIM first, then add a DMARC record.
What's the problem
A checker or your email provider says your domain has no DMARC record, or your emails are being flagged by Gmail or Yahoo.
Why it happens
- The domain was set up for email without it. DMARC is a separate record that hosts and email services don't always add.
- The record is in the wrong place: it must be a TXT record named
_dmarc, not on the domain itself. - There are two DMARC records, which receiving servers can't use.
How to fix it
- Make sure SPF and DKIM pass for the services you send from.
- Add a TXT record named
_dmarcwith a value likev=DMARC1; p=none; rua=mailto:[email protected]. - Read the reports that arrive at that address for a few weeks, to find services sending as you that fail.
- Tighten the policy to
p=quarantine, thenp=reject, once legitimate mail passes.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows your email authentication: SPF (and its 10-lookup limit), DMARC and DKIM; whether mail to you must arrive encrypted (MTA-STS) and whether you get reports when it does not; your DNS: nameservers, addresses, DNSSEC, and records pointing at services that no longer exist. It can't see your sending provider's delivery logs, so check bounces there.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- Google: Set up DMARChelp center
DMARC tells receiving email servers what action to take on messages sent from your domain that don't pass SPF or DKIM authentication.
- Google: Email sender guidelineshelp center
Bulk senders (more than 5,000 messages daily) must Set up SPF , Set up DKIM , and Set up DMARC .