Fix guide · Email · low

DMARC missing or set to p=none

DMARC tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM. With no record, or with p=none, anyone can send mail that appears to come from you, and it gets delivered.

Time to fix

10 minutes, then a few weeks of watching

Risk if ignored

Phishing in your name

Breaks anything?

p=reject can block your own mail if SPF/DKIM are incomplete

How to fix it

Add a TXT record named _dmarc at your DNS provider:

v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

Reports arrive daily. Use them to find every service that sends mail as you.

Cloudflare and most mail providers offer free DMARC report dashboards, so you do not have to read raw XML.

Check your fix

Common mistakes

Jumping straight to p=reject before checking reports, and blocking your own newsletter or invoicing tool.
Publishing two DMARC records. Receivers then ignore both.
Forgetting that subdomains inherit the policy unless you set sp=.