Your domain has no DMARC record: what that means for your email

#email #webdev #devops #security

If you run dig TXT _dmarc.yourdomain.com and get nothing back, your domain has no DMARC record. That single missing DNS entry has real consequences for inbox placement and domain security.

What DMARC actually does

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS policy that tells receiving mail servers what to do when an email claiming to be from your domain fails SPF or DKIM checks.

Without it, providers like Gmail and Outlook make their own call. That call often involves the spam folder.

Beyond delivery, DMARC is the only mechanism you have to prevent domain spoofing. Without a record, anyone can send email that appears to come from your domain and receiving servers have no policy to block it.

The Gmail and Yahoo requirement

Since February 2024, Gmail and Yahoo require a DMARC record for senders sending more than 5,000 emails per day. Below that threshold it is still best practice.

Missing DMARC is one of the first things bulk email infrastructure checks when deciding whether to trust a sender.

The minimum record to add

You do not need a strict policy to start. This is enough to pass the check and begin receiving reports:

Type:  TXT
Name:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Replace the rua address with a real mailbox you can read. p=none means no action is taken on failures, but you start receiving aggregate reports showing exactly what is authenticating and what is not.

Once SPF and DKIM are passing consistently, upgrade to p=quarantine or p=reject.

Where to add it

Cloudflare: DNS > Records > Add record > TXT, name _dmarc
Namecheap: Advanced DNS > Add New Record > TXT, host _dmarc
GoDaddy: DNS > Manage Zones > Add Record > TXT, name _dmarc

Most panels prepend your domain automatically. Use just _dmarc, not _dmarc.yourdomain.com.

Verify it worked

After saving, wait 5 to 30 minutes, then run:

dig TXT _dmarc.yourdomain.com

You should see your record in the answer section. You can also run a free scan at InboxGreen, which checks DMARC alongside SPF, DKIM, and List-Unsubscribe in one go.

For the full step-by-step guide including common mistakes and FAQ: DMARC record not found: fix guide