auth.dmarc.missing

DMARC Record Missing

What we check

We query DNS for a TXT record at _dmarc.<domain>. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving mail servers what to do with messages that fail authentication — reject them, quarantine them, or just send you a report.

What this finding means

No DMARC record was found at _dmarc.<domain>. Without one, receiving servers have no policy to enforce: they may deliver, junk, or drop unauthenticated mail at their own discretion — and you get no visibility into who is sending as your domain.

Why it matters

Spoofing exposure. Anyone can send email claiming to be from your domain. Without DMARC, receivers have no machine-readable signal to reject it.
No reporting. DMARC aggregate reports (rua) are the only standardised way to see who is using your domain in From: headers — legitimate services and attackers alike. Without a record, you fly blind.
Deliverability risk. Major mailbox providers (Google, Microsoft, Yahoo) increasingly require DMARC. Domains without it see higher junk-folder rates.

How to fix

Start with a monitoring policy. Publish a TXT record at _dmarc.<domain>:
```
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
```
p=none means receivers will not act on failures yet — they only send you reports.
Review the reports. Identify all legitimate mail sources (your mail server, transactional services, marketing platforms). Make sure each one passes SPF or DKIM alignment.
Tighten the policy. Once legitimate sources are aligned, move to p=quarantine (unauthenticated mail goes to junk), then to p=reject (unauthenticated mail is refused outright).

DNS record example

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

How it's graded

A missing DMARC record sets the Authentication category baseline to 0 (the effective policy is "absent"). Combined with any other authentication deductions, this typically results in a low overall grade. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT _dmarc.example.com
(empty — no record)