Skip to content

DMARC record

mediumsecurity-dmarcreviewed

DMARC tells receiving servers what to do with mail that fails SPF or DKIM. p=none only monitors — here's the record and how to tighten it.

What it is

DMARC is a DNS TXT record at _dmarc.<domain> that tells receiving mail servers what to do with a message that fails SPF or DKIM authentication, and where to send reports about it. Its policy value — p=none, p=quarantine or p=reject — sets how strictly that's enforced.

p=none is a valid DMARC record, but it only monitors: it asks receiving servers to report failures, without asking them to act on one.

Why it matters

A domain with SPF and DKIM but no DMARC — or one stuck at p=none — still has no automated defense against spoofed email actually reaching an inbox. The authentication signals exist, but nothing acts on a failure.

The usual rollout is p=none first, to review the aggregate reports for legitimate senders that would otherwise get blocked, then moving to p=quarantine and eventually p=reject once those reports are clean.

When it is skipped

Skipped, and not counted either way, when the DNS lookup fails.

How to fix it

with a reference doc
DNS TXT record — start in monitor mode
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"
DNS TXT record — tightened after reports are clean
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Reference documentation

Related checks

3
mediumSPF recordSPF (Sender Policy Framework) is a DNS TXT record on a domain's apex that lists which mail servers are authorized to send email as that domain. A receiving mail server checks the sending IP against this list before accepting a message.criticalSSL certificate validityThis checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

This is one of the 77 checks scanner v2.1.0 runs. See what we check for the full list, every severity weight, and how the score is computed from them.

See whether your own site passes dmarc record.

One page, 74 checks, free. No account, no card.

Check this on my site