What this means
The finding means a DNS lookup for a TXT record at _dmarc.yourdomain.com returned nothing, and possibly that your domain has no v=spf1 record either. SPF (RFC 7208) lists the servers allowed to send for your domain. DMARC (RFC 7489) builds on SPF and DKIM: it checks that the visible From address matches an authenticated domain and publishes your policy for failures: none, quarantine or reject.
Why it happens
- The domain was bought for an app, and email was set up later through a provider's wizard that did not include DMARC.
- Sending was added by an AI-generated integration (Resend, SendGrid, Postmark, SES) and the DNS step in the provider's dashboard was skipped.
- The domain sends no email, so nobody thought records were needed. Unused domains are attractive for forgery for exactly that reason.
- DNS was moved to a new host, such as when pointing the domain at Vercel or Cloudflare, and TXT records were not copied across.
How to fix it
- 1List every service that sends email as your domain: your mailbox provider, transactional email service, marketing tool, support desk.
- 2Publish a single SPF TXT record on the root domain that includes each of them. A domain must have only one v=spf1 record. Two records cause a permanent error. Keep within SPF's limit of 10 DNS lookups.
- 3Turn on DKIM signing in each sending service and add the DNS records it gives you. DMARC needs SPF or DKIM to pass and align, and DKIM survives forwarding better.
- 4Add a DMARC TXT record at the host _dmarc with p=none and an rua address, so you receive aggregate reports without affecting delivery.
- 5Read the reports for a few weeks. Fix any genuine sender that fails.
- 6Tighten the policy to p=quarantine, then p=reject.
- 7For a domain that sends no email at all, publish the locked-down records shown last below.
Host: @
Value: v=spf1 include:_spf.google.com include:YOUR_EMAIL_PROVIDER_SPF_HOST ~all
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Host: _dmarc
Value: v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com
Host: @
Value: v=spf1 -all
Host: _dmarc
Value: v=DMARC1; p=rejectHow to confirm the fix
Query your own domain's DNS. You should see exactly one SPF record and one DMARC record. Then send a message from each of your services to a mailbox you own, open the original message source and look at the Authentication-Results header for spf=pass, dkim=pass and dmarc=pass.
dig +short TXT yourdomain.com | grep -i spf1
dig +short TXT _dmarc.yourdomain.com
nslookup -type=TXT _dmarc.yourdomain.comFrequently asked questions
Does p=none protect me?
No. It is a monitoring mode that asks receivers to take no action and send you reports. Protection starts at quarantine and is strongest at reject.
What is the difference between ~all and -all in SPF?
~all is a soft fail and -all is a hard fail for senders not on your list. With DMARC in place the DMARC policy decides the outcome, so many domains keep ~all and enforce through DMARC.
Do subdomains need their own records?
A DMARC record on the organisational domain covers subdomains unless they publish their own, and the sp tag sets a separate subdomain policy. SPF is per host, so a subdomain that sends mail needs its own SPF record.
How long do changes take?
DNS changes usually show within minutes to a few hours, depending on the record's TTL. DMARC aggregate reports are typically sent daily.