“No DMARC record found” — what it actually means, and the record to publish

You ran a mail tester, a DNS lookup or a security scan against your own domain and it came back no DMARC record found. This page tells you what that sentence means in practice, what it does and does not put at risk, and the exact DNS record to publish — in the order that will not break your own email.

What the message means

DMARC is a single line of text published in your domain’s DNS, at the name _dmarc.yourdomain.com. It is an instruction addressed to every mail server on the internet, and it says: when a message arrives claiming to be from this domain and it fails authentication, here is what I want you to do about it.

“No DMARC record found” means you have never published that instruction. It is not a warning that something has broken. It is a report that a control was never switched on.

What actually happens without it

Anyone, anywhere, can compose an email, put yourcompany.com in the From: line, and send it. That is not a flaw in your setup; it is how SMTP has always worked. The address in the From: header is typed by the sender, the way a return address is written on an envelope by hand.

SPF and DKIM let a receiving server detect that a message did not come from you. DMARC is the part that tells it what to do once it has detected that. Without DMARC, the receiver has the evidence and no instruction, and the overwhelming default is to deliver the message anyway. The practical result:

• A forged invoice with your company in the From line reaches your customer’s inbox looking exactly like every real one you have ever sent.
• A message to your own staff, apparently from a director, asking for a payment detail change, arrives with nothing to mark it as foreign.
• You find out when somebody phones to ask whether the email was really from you.

What it does not do. DMARC does not protect against lookalike domains — yourc0mpany.com is a different domain and your record has no authority over it. It does not encrypt anything, it does not stop spam arriving to you, and it does not secure your website. It governs one thing: mail that claims to be from you.

The record to publish

Create a TXT record in the DNS for your domain:

Name:   _dmarc
Type:   TXT
Value:  v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain

Some control panels want the full name _dmarc.yourcompany.com instead of just _dmarc. Both are the same record; use whichever form your provider asks for. TTL can be left at the default.

Publish p=none first, and do not skip this. It is the setting that asks receivers to do nothing except send you reports. It is deliberately harmless, and its whole purpose is to show you which of your own systems — the invoicing tool, the CRM, the newsletter platform, the booking form — are sending as you without being authorised. Going straight to p=reject before you know that list is the single most common way a business breaks its own mail, and it breaks it silently: the messages are refused at the far end and nobody tells you.

Then move it, or it was never worth publishing

This is the part most instructions leave out, and it is the reason the second-largest finding in our data exists at all. A DMARC record at p=none is a monitoring stage, not a destination. Leave it there and you have a record that reports forgery after the fact and asks nobody to stop it.

1. Weeks 1–2 — p=none. Collect the aggregate reports arriving at your rua address. Every sender you recognise and intend to keep needs to be authorised in SPF, signed with DKIM, or both.
2. Then p=quarantine. Failing mail goes to spam rather than the inbox. Recoverable if you have missed a sender.
3. Then p=reject. Failing mail is refused outright. This is the setting that actually stops the forged invoice.

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain; fo=1

The aggregate reports arrive as compressed XML and are close to unreadable by eye. Any of the free DMARC report readers will parse them; you do not need to buy a platform to get through the first two weeks.

How to check that it worked

DNS changes propagate in minutes to hours. From a terminal:

nslookup -type=TXT _dmarc.yourcompany.com
dig +short TXT _dmarc.yourcompany.com

You are looking for a single string beginning v=DMARC1. Two DMARC records on the same name is a defect — receivers are entitled to ignore both, which puts you back where you started while every checker reports that a record exists.

What we measured, and on whom

Most articles on this subject quote a global adoption figure from a vendor report. We wanted a number for the population a small business actually belongs to, so we measured it directly, from the outside, using only what these domains publish to the entire internet.

The second row is the one worth sitting with. These are businesses that paid a professional to build their website, and 69.7% of them still publish no enforcing DMARC policy. Of the 29 agencies in the sample with five or more sites in their portfolio, 0 had a clean sheet across all of them.

Every figure on this page is generated from the stored raw measurement files behind our 604-domain study (522 agency-built sites measured 2026-08-20, 83 independent domains measured 2026-08-01), and the quoted finding wording is read out of the running checker at build time. An automated control re-asserts both against this live page on every operating cycle; if either changed and this page did not, it fails. Generated 2026-09-05T23:34:13Z.