On this page

Fixing DMARC Record Issues

What it does

DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do with messages that fail SPF or DKIM checks, and lets you receive reports about spoofing attempts against your domain.

This is a DNS-only fix, but it depends on SPF and DKIM already being set up correctly — see Fixing SPF Record Issues and Fixing DKIM Record Issues first if you haven't already.

How to fix it

  1. Add a TXT record on _dmarc.yourcompany.com with a value like:
    v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1
  2. Make sure the key tags are set correctly:
    • p= (policy) — use quarantine (send failing mail to spam) or reject (block it outright). Avoid p=none, which takes no action.
    • rua= — an email address to receive aggregate (summary) reports.
    • ruf= — an email address to receive forensic (per-message failure) reports.
    • fo= — controls when forensic reports are generated. Use fo=1 (report if either SPF or DKIM fails) or fo=0 (report only if both fail).
  3. If you're just starting out, it's safest to begin with p=none while you review the aggregate reports, then move to p=quarantine and eventually p=reject once you're confident all legitimate senders pass.
  4. Save the record, allow time for propagation, and re-run a scan to confirm it passes.

Common pitfalls

  • Setting p=reject before verifying all legitimate senders (marketing tools, CRMs, etc.) pass SPF/DKIM — this can silently block real email.
  • Leaving out the fo= tag, which limits the detail in forensic reports.
  • SPF and DMARC alignment: if DMARC is enabled, your SPF record should ideally end in -all (hard fail) for DMARC's SPF checks to be meaningful.
  • Not monitoring the aggregate (rua) reports once set up — they're only useful if someone actually reviews them periodically.