No DMARC record on your domain

What it means

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that ties SPF and DKIM together. It tells receiving servers two things:

• What to do with an email that claims to come from your domain but fails the checks: deliver it, send it to spam, or reject it.
• Where to send reports about who is sending email with your domain name.

Why it matters

• Gmail and Yahoo require a DMARC record for anyone sending large volumes, and Microsoft Outlook follows the same direction.
• Without DMARC, scammers can send fake invoices or phishing emails that look like they come from you.
• The reports show you every service sending in your name, including the ones you forgot.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The DMARC line says your domain has no policy.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

How to fix it

1. Make sure SPF and DKIM are set up first. DMARC relies on them.
2. Choose an address for reports. Reports are XML files sent daily by Gmail, Microsoft, Yahoo and others. A separate mailbox such as dmarc@yourdomain.com is a good idea.
3. Open your DNS provider and add a TXT record with the name _dmarc.
4. Start in monitoring mode (p=none). Nothing is blocked; you just receive reports.

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

What each part means

• v=DMARC1: this is a DMARC record. It must come first.
• p=none: the policy. none only monitors, quarantine sends failures to spam, reject refuses them.
• rua=mailto:...: where daily summary reports go.

Tips

• Only one DMARC record per domain. With two, receivers ignore DMARC completely.
• The name is _dmarc (with the underscore). Some DNS providers want only _dmarc, others the full _dmarc.yourdomain.com.
• Reports are hard to read by hand. Delivmail DMARC monitoring, in the paid dashboard, receives and summarizes them for you.
• Monitoring mode is a first step, not the goal. After a few weeks of clean reports, move to p=quarantine, then p=reject. See the guide on moving DMARC to quarantine or reject.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Run the Domain scanner: DMARC should be found, with your policy and report address. Then send a test email from the home page. The DMARC line should show a pass, as long as SPF or DKIM passes for your domain.

More help: Google's DMARC guide.