Last updated: 22 March 2026

No DMARC policy: what it means and how to fix it

A missing DMARC record means your domain has no policy telling email providers how to handle messages that fail authentication. This leaves your domain open to email spoofing, can cause legitimate emails to land in spam, and hurts deliverability with providers like Google and Microsoft. Without DMARC, you also have no visibility into who is sending email as your domain.

What is DMARC

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS record that tells receiving mail servers what to do when an email claiming to be from your domain fails SPF or DKIM checks.

It works alongside SPF and DKIM to form a three-layer email authentication system. SPF verifies which servers are allowed to send email for your domain. DKIM adds a cryptographic signature to each message. DMARC ties them together by defining a policy: what should happen when those checks fail.

DMARC also enables reporting. When you publish a DMARC record with a rua tag, email providers send you aggregate reports showing who is sending email on your behalf, whether it passed or failed authentication, and from which IP addresses. This gives you visibility into both legitimate senders and potential spoofing attempts.

What a DMARC record looks like

A DMARC record is a TXT entry in your DNS, published at _dmarc.yourdomain.com.

Here is a full example record with each tag explained:

Without vs with DMARC

The difference is straightforward. Think of DMARC as a policy sign on your front door.

Why this matters

When no DMARC record exists, email providers make their own decisions about suspicious messages. Most will still deliver them, which means spoofed emails can reach inboxes unchallenged. This creates several problems:

• Email spoofing. Anyone can send phishing emails that look like they come from your domain. This is used to target your customers, partners, and employees.
• No visibility. Without DMARC reporting, you cannot see who is sending email using your domain name. You have no way to detect abuse.
• Deliverability impact. Google, Microsoft, and Yahoo increasingly require DMARC. As of February 2024, Google and Yahoo require DMARC for domains sending more than 5,000 emails per day. Missing it can hurt your delivery rates.
• Brand damage. Spoofed emails erode trust in your brand and can lead to your domain being blocklisted by email providers.
• Compliance requirements. Many industries (finance, healthcare, government) require DMARC as part of their security standards. PCI DSS 4.0 also recommends it.

DMARC is now a standard requirement for modern email security and is increasingly enforced by major providers like Google and Microsoft. It is no longer optional for domains that send email.

How to tell if this is your issue

Not sure if a missing DMARC record is causing your problem? These are common signs that point to email authentication issues:

• Your emails are going to spam. If recipients report that your messages land in junk or spam folders, a missing DMARC record may be a contributing factor. Email providers use DMARC as a trust signal when deciding where to place messages.
• You received a security warning from Google or Microsoft. Both providers now send alerts to domain administrators when they detect authentication gaps. If you received a notification about email authentication, check your DMARC record first.
• Someone reported a phishing email from your domain. If a customer, partner, or colleague received a suspicious email that appeared to come from your domain, a missing DMARC record means there was nothing in place to stop it.
• You are setting up email on a new domain. If you have just registered a domain or are configuring email for the first time, adding DMARC alongside your SPF record should be part of your initial setup.
• A domain health scan flagged this issue. Tools like 1Pane check for DMARC as part of a broader domain health assessment. If this was flagged in a scan, it means the record is either missing or invalid.

When this becomes a problem

A missing DMARC record does not cause immediate failures, but it creates ongoing risk. The impact becomes visible when:

• Someone spoofs your domain. A phishing attack using your domain can happen at any time. Without DMARC, there is nothing to prevent it and no way to detect it.
• You send transactional email. If your application sends order confirmations, password resets, or invoices, DMARC protects those messages from being impersonated.
• You scale email volume. Bulk senders (5,000+ messages/day) are now required to have DMARC by major providers. Without it, your deliverability drops. This is also affected by DNS resolution issues that prevent records from being found.
• You use third-party senders. If services like Mailchimp, SendGrid, or HubSpot send email on your behalf, DMARC reports help you track whether they are properly authenticated.
• A customer reports a phishing email. At that point you are already dealing with the consequences rather than preventing the problem.

How to fix it properly

Follow these steps to add DMARC to your domain and move toward full email spoofing protection.

Step 1: Check your SPF and DKIM records

DMARC depends on SPF and DKIM. Before adding DMARC, make sure your domain has a valid SPF record and that your email provider has enabled DKIM signing. Without these, DMARC has nothing to enforce.

Step 2: Start with a monitoring policy

Add a DMARC record with p=none so you can collect data before enforcing.

The rua tag tells email providers where to send daily aggregate reports in XML format. These reports list every IP address that sent email using your domain and whether it passed SPF and DKIM.

Step 3: Review your reports

After a week or two, review the DMARC reports. Look for legitimate sending services that may not be properly configured. Common sources include:

• Your email hosting provider (Google Workspace, Microsoft 365)
• Marketing platforms (Mailchimp, HubSpot, SendGrid)
• Transactional email services (Postmark, Amazon SES)
• Helpdesk or CRM tools that send from your domain

Make sure each of these is included in your SPF record and has DKIM configured.

Step 4: Tighten your policy

Once all legitimate senders pass authentication, upgrade your policy in stages:

Step 5: Verify your record

After adding the record, verify it is live. DNS propagation usually takes a few minutes to a few hours. If the record is not appearing, check for DNS resolution issues that might be preventing lookups. You can check by running:

Or use a 1Pane domain health scan to verify the record is detected and valid.

Common mistakes

• Wrong hostname. The record must be at _dmarc.yourdomain.com, not at the root domain. Some DNS providers add the domain suffix automatically, so you only need to enter _dmarc as the host. Others require the full _dmarc.yourdomain.com. Check your provider's documentation.
• Missing v=DMARC1. The record must start with v=DMARC1 exactly. Typos, extra spaces, or missing semicolons will cause email providers to ignore the entire record.
• Multiple DMARC records. Your domain must have exactly one DMARC TXT record. If more than one exists, email providers may ignore all of them. Remove duplicates before adding a new one.
• Jumping straight to p=reject. If you enforce rejection before verifying that all legitimate senders are authenticated, you will block your own email. Always start with p=none and review reports first.
• No SPF record. DMARC checks SPF alignment. If you have no SPF record, half of DMARC's validation is missing. Set up SPF before or alongside DMARC.
• Ignoring subdomains. By default, subdomains inherit the parent domain's DMARC policy. If you need different policies for subdomains, use the sp tag (e.g. sp=reject).

DMARC vs SPF vs DKIM: what is the difference

These three protocols work together to protect your domain from email spoofing. Each handles a different part of email authentication.

SPF and DKIM each solve part of the problem. DMARC ties them together by adding a policy layer and reporting. For full email spoofing protection, you need all three. If your domain is also missing an SPF record, see SPF record missing.

How 1Pane detects this

When you scan a domain with 1Pane, it queries the DNS TXT records at _dmarc.yourdomain.com. If no record is found, or the record does not contain a valid DMARC policy starting with v=DMARC1, the scan flags it as a critical issue.

1Pane also checks for related problems that affect DMARC effectiveness, including missing SPF records and DNS resolution failures. Changes between scans are tracked, so you can verify that your fix has taken effect.

Related issues

These domain health issues are closely related to DMARC and email authentication: