DMARC record

mediumsecurity-dmarc

DMARC tells receiving servers what to do with mail that fails SPF or DKIM. p=none only monitors — here's the record and how to tighten it.

What it is

DMARC is a DNS TXT record at _dmarc.<domain> that tells receiving mail servers what to do with a message that fails SPF or DKIM authentication, and where to send reports about it. Its policy value — p=none, p=quarantine or p=reject — sets how strictly that's enforced.

p=none is a valid DMARC record, but it only monitors: it asks receiving servers to report failures, without asking them to act on one.

Why it matters

A domain with SPF and DKIM but no DMARC — or one stuck at p=none — still has no automated defense against spoofed email actually reaching an inbox. The authentication signals exist, but nothing acts on a failure.

The usual rollout is p=none first, to review the aggregate reports for legitimate senders that would otherwise get blocked, then moving to p=quarantine and eventually p=reject once those reports are clean.

How to fix it

with a reference doc
DNS TXT record — start in monitor mode
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"
DNS TXT record — tightened after reports are clean
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

Reference documentation

Related checks

3
mediumSPF recordSPF (Sender Policy Framework) is a DNS TXT record on a domain's apex that lists which mail servers are authorized to send email as that domain. A receiving mail server checks the sending IP against this list before accepting a message.criticalSSL certificate validityThis checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

See whether your own site passes dmarc record.

One page, all 75 checks, free. No account, no card.

Run a scan