auth.dmarc.invalid_policy

DMARC Policy Not Valid

What we check

We read the p= tag of the DMARC record and, if present, the sp= tag. Each must be one of none, quarantine or reject. This finding means the p= tag is missing or carries another value (a typo such as p=rejekt), or sp= carries an invalid value.

What this finding means

RFC 7489 §6.6.3 tells receivers exactly what to do with such a record: if it names an aggregate-report destination (rua=), act as if p=none had been published; if it does not, apply no DMARC processing at all. Either way the enforcement you meant to publish does not exist. We grade the record the way receivers treat it — the DMARC baseline is that of p=none (59) with a rua=, and that of a missing record (0) without one — rather than the policy the typo was aiming at.

Why it matters

• A typo silently switches enforcement off. p=rejekt looks like reject to a human and like nothing to a receiver.
• Without rua= the record is inert. No reports, no policy: the domain is exactly as exposed as one that never published DMARC.
• Strict receivers may discard more. Some implementations treat any malformed record as absent regardless of rua=.

How to fix

1. Correct the policy tag (and sp= if you use it):

   copy

   _dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
   

2. Keep rua= so that, should a record ever break again, receivers at least fall back to monitoring and you keep receiving reports.

3. Re-scan. The finding clears once p= (and sp=) hold a valid policy.