Where you saw it: A DMARC checker returning no record, a deliverability audit flagging the domain, or a Gmail bulk sender warning in Postmaster Tools.
Why it happens
- It was never created. DMARC is opt-in and no platform publishes it on your behalf.
- The record was published at the domain root instead of the _dmarc subdomain, where receivers never look for it.
- A DNS migration carried the A and MX records across and left the TXT records behind.
- The record exists on a different domain in the organization and someone assumed it covered this one.
The fix, in order
Confirm SPF or DKIM works first
DMARC evaluates those two results. Publishing a policy on a domain where neither passes turns a filtering problem into a rejection problem the moment you tighten it.
Set up a mailbox for the reports
Aggregate reports arrive as compressed XML, daily, from every receiver that honors the policy. Point them somewhere that will not drown a person's inbox.
Publish a monitoring policy
Create a TXT record at _dmarc.yourdomain.com with a value of v=DMARC1; p=none; rua=mailto:your-report-address. That collects data and changes nothing about delivery.
Read reports for two weeks
You are looking for every legitimate sending source and whether each one passes with alignment. A parser or a monitoring service makes this bearable; raw XML does not.
Move to quarantine, then reject
Once every legitimate source passes, raise the policy in steps with the pct tag rather than all at once.
How to know it worked
The short version
- dig +short TXT _dmarc.yourdomain.com returns a value beginning v=DMARC1.
- Aggregate reports start arriving at your rua address within a day or two.
- A DMARC checker reports the policy and the report address correctly.
Questions people ask
Is DMARC required?
For bulk senders to Gmail and Yahoo, yes, since February 2024. For everyone else it is optional and increasingly expected by the receivers that decide where your mail lands.
Will publishing p=none affect my delivery?
No. It asks receivers to report and to take no action. That is exactly why it is the right starting point.
What address should receive the reports?
A mailbox or a monitoring service, never a person's main inbox. A medium-sized domain generates a meaningful number of compressed XML attachments every day.