DMARC policyWhat it checks and how to fix it

What it checks

Reads the TXT record at _dmarc.<domain>. Passes when a single DMARC record sets p=quarantine or p=reject, warns when the policy is p=none (monitor only) or cannot be read, or when more than one DMARC record is published, and fails when there is no DMARC record.

Why it matters

DMARC tells receiving mail servers what to do with messages that claim to come from your domain but fail SPF and DKIM. With no record, or with p=none, spoofed mail using your exact address still reaches inboxes, which is how most brand phishing works. Gmail and Yahoo also require a DMARC record from bulk senders.

How to fix it

Publish exactly one DMARC record, and move it to enforcement in stages so legitimate mail is not caught.

1. Monitor. Start with p=none and a reporting address, and read the aggregate reports for two to four weeks:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

2. Fix your senders. Every service that sends as your domain (your mail provider, newsletter tool, CRM, transactional mail) must pass SPF or DKIM with your domain aligned. The reports show which ones do not.

3. Enforce. Move to quarantine, optionally for a share of the mail first, then to reject:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com"
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

A domain that never sends mail can go straight to v=DMARC1; p=reject;, together with the SPF record v=spf1 -all.

In Cloudflare DNS the record name is _dmarc; Cloudflare's free DMARC Management also collects and summarizes the reports for you.

dig +short TXT _dmarc.example.com