Email Security8 min read

"No DMARC record found" — Causes & Fix

A checker, a mailbox provider or a compliance scan reports that your domain has no DMARC policy. Either you have not published one, or you published it somewhere receivers do not look.

"No DMARC record found" means a lookup for the TXT record at _dmarc.yourdomain.com returned nothing usable. There are only two possibilities: you have never published a DMARC record, or you published one that receivers cannot see — wrong hostname, invalid syntax, or duplicated. The distinction matters, because the second case looks exactly like success in your DNS control panel while providing no protection at all.

What the Error Looks Like

text
# Online checkers and compliance scans No DMARC record found for example.com DMARC record not detected — your domain is not protected against spoofing example.com has no DMARC policy published # Google Postmaster Tools / bulk sender compliance Your domain does not have a DMARC policy. Set up DMARC to comply with sender requirements. # What a lookup actually returns $ dig +short TXT _dmarc.example.com (no output)

Empty output from that dig is the ground truth. Everything below is about why it is empty when you believe it should not be.

Resolve your domain in the DMARC Lookup tool

Why It Matters

Without a DMARC record, receivers have no instruction about what to do with mail that fails authentication using your domain in the From: header. In practice that means anyone can send mail appearing to come from your domain and it will be delivered on its own merits. SPF and DKIM alone do not prevent this — neither of them looks at the visible From: address.

Since 2024, Google and Yahoo require a DMARC record for bulk senders, so a missing record is now a deliverability problem as well as a security one.

Why It Happens

1. No record has ever been published

The common case, and the simplest to fix. Publishing SPF and DKIM does not create a DMARC record — it is a separate TXT record at its own hostname. Go to the fix below.

2. Published at the wrong hostname

The record must live at _dmarc.example.com, not at example.com. A record published at the apex is not a DMARC record no matter how correct its contents:

text
# Wrong — nothing looks here for DMARC example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" # Right _dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

3. The DNS panel appended your domain twice

Most providers ask for the host or name portion only and append the domain themselves. Entering the fully qualified name produces a doubled hostname:

bash
# You typed this in the "Host" field: _dmarc.example.com # The provider stored this: _dmarc.example.com.example.com. IN TXT "v=DMARC1; p=none" # Confirm which one exists dig +short TXT _dmarc.example.com dig +short TXT _dmarc.example.com.example.com

If the second command returns your record, the host field should contain just _dmarc. Cloudflare, GoDaddy, Namecheap and Route 53 all behave this way; a handful of others expect the full name, so check what your existing records look like.

4. The record does not start with v=DMARC1

Receivers only treat a TXT record as DMARC if it begins with exactly v=DMARC1. Anything else is ignored entirely, which reads as "no record found":

text
"p=none; v=DMARC1" # invalid — v must be first "v=DMARC1.0; p=none" # invalid — the value is exactly DMARC1 "V=DMARC1; p=none" # the tag name is case-sensitive " v=DMARC1; p=none" # leading whitespace breaks the match "v=DMARC1" # valid syntax but no p= — treated as invalid

5. Two DMARC records exist

More than one TXT record at _dmarc beginning with v=DMARC1 is a fatal error. Receivers do not pick the stricter one or merge them — they treat the domain as having no policy:

bash
$ dig +short TXT _dmarc.example.com "v=DMARC1; p=none; rua=mailto:dmarc@example.com" "v=DMARC1; p=reject" # Two records = no policy. Delete one.

This usually happens when a vendor onboarding wizard adds a record without checking for an existing one.

6. Smart quotes or invisible characters

Pasting a record from a document, a chat message or a PDF can substitute typographic quotes (“ ”) for ASCII ones, or introduce a non-breaking space. The record looks perfect in the control panel and parses as garbage. Retype it by hand if you suspect this.

7. You are checking a subdomain

Subdomains normally inherit the parent's policy rather than publishing their own, so a direct lookup of _dmarc.mail.example.com legitimately returns nothing while mail.example.com is still protected by the record at _dmarc.example.com. Some naive checkers report this as an error. Check the organizational domain instead.

8. DNS has not propagated yet

A newly added record takes up to the zone's TTL to become visible everywhere. If you published minutes ago, query your authoritative nameserver directly to confirm it exists before assuming something is wrong.

How to Diagnose It

bash
# 1. The basic check — what does the world see? dig +short TXT _dmarc.example.com # 2. Bypass caching and ask the authoritative nameserver directly dig +short NS example.com dig +short TXT _dmarc.example.com @ns1.yourprovider.com # 3. Count records — anything other than 1 is a problem dig +short TXT _dmarc.example.com | grep -c 'v=DMARC1' # 4. Check for the doubled-hostname mistake dig +short TXT _dmarc.example.com.example.com # 5. Reveal hidden characters in what is published dig +short TXT _dmarc.example.com | cat -A

Step 5 is worth running whenever a record looks right but behaves as though it is absent — cat -A exposes stray whitespace and non-ASCII bytes that are invisible otherwise.

How to Fix It

Publish a monitoring record first

Start with p=none. It changes nothing about delivery and immediately resolves the "no record found" error while you gather data:

text
Type: TXT Host: _dmarc (just "_dmarc", not the full domain) Value: v=DMARC1; p=none; rua=mailto:dmarc@example.com TTL: 3600
Do not publish p=reject as your first recordIt is tempting to jump straight to enforcement to satisfy a compliance scan. Doing so before you know which systems send as your domain means silently rejecting legitimate mail — invoicing, ticketing, monitoring alerts. Publish p=none today and enforce once reports show every sender aligned.

Include a reporting address

The rua= tag is technically optional and practically essential — without it you get a policy with no feedback. Point it at a dedicated mailbox rather than a person's inbox. See How to Set Up DMARC Aggregate Reporting.

Fix a doubled or misplaced record

Delete the incorrect entry rather than leaving it alongside a new one — a stale _dmarc.example.com.example.com record is harmless, but a second record at the correct hostname breaks everything.

Then verify

bash
dig +short TXT _dmarc.example.com "v=DMARC1; p=none; rua=mailto:dmarc@example.com" # Exactly one line, starting with v=DMARC1. That is a working record.
Allow for propagationIf the old answer was cached, wait for the previous TTL to expire before re-testing from a resolver. Querying the authoritative nameserver directly, as in the diagnosis section, gives you the truth immediately.

What to Do Next

A record at p=none resolves the error but does not protect the domain. The path from here:

  1. Collect two to four weeks of aggregate reports.
  2. Inventory every sending source and identify its owner.
  3. Fix SPF and DKIM until each legitimate source produces an aligned pass.
  4. Ramp to p=quarantine, then p=reject.

The full path is in Rolling Out DMARC. If your domain sends no mail at all, you can skip the ramp entirely and publish a strict parked-domain record today.

text
# Parked domain that should never send mail _dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com" example.com. IN TXT "v=spf1 -all"

Frequently Asked Questions

Is a missing DMARC record actually a problem?

Yes, on two fronts. Anyone can send mail appearing to come from your domain, and since 2024 Google and Yahoo require DMARC for bulk senders — so a missing record affects deliverability as well as security.

I published the record but checkers still say it is missing. Why?

In order of likelihood: the host field created a doubled hostname; the record is at the apex instead of _dmarc; it does not start with v=DMARC1; there are two records; or DNS has not propagated. Run dig +short TXT _dmarc.example.com against your authoritative nameserver to see the truth.

Do I need SPF and DKIM before publishing DMARC?

Not for p=none — publish it today and start collecting reports. You do need at least one of them working and aligned before enforcing, since DMARC has nothing to pass on otherwise.

Does every subdomain need its own DMARC record?

No. Subdomains inherit the parent's policy automatically, and sp= lets you override it for all of them at once. Publish a per-subdomain record only when one subdomain genuinely needs a different policy.

What is the minimum valid DMARC record?

v=DMARC1; p=none. That is valid and complete, though without rua= you get no reports, which makes it impossible to progress toward enforcement.

How long until the record is visible?

New records typically appear within minutes, but resolvers that already cached the empty answer may take up to an hour. Query your authoritative nameserver directly to confirm publication immediately.

Related