DMARC is a DNS record that tells receiving mail servers what to do with email that fails SPF or DKIM checks, and where to send reports about it. Start in monitor mode (`p=none`) for a couple of weeks to see what mail is sending as your domain, then move to an enforcing policy.
Why it matters
Without DMARC, SPF and DKIM exist but nothing tells receiving servers what to do when a message fails them, so spoofed mail using your domain can still land in someone's inbox looking legitimate.
A DMARC record present but set to `p=none` (monitor only, the default when first set up) reports on failures but does not stop them. It is a necessary first step, not the finished job.
Mailbox providers increasingly weight DMARC enforcement when deciding whether to trust mail from a domain at all, which affects deliverability for your genuine invoices, quotes and replies, not just for blocking impersonators.
How AuditCrow checks this
AuditCrow looks up the `_dmarc` TXT record for the domain, confirms it exists and is syntactically valid, and reads its policy (`p=none`, `p=quarantine`, or `p=reject`) as part of a wider window-scored assessment rather than a single pass or fail.
How to fix it
- 1Add a TXT record at `_dmarc.yourdomain.com` starting `v=DMARC1;`. A safe starting point is `v=DMARC1; p=none; rua=mailto:you@yourdomain.com;`, which only monitors and reports, changing nothing about delivery yet.
- 2Watch the aggregate reports (the `rua` address) for a couple of weeks to confirm every legitimate mail source you use is passing SPF or DKIM.
- 3Once you are confident nothing legitimate is failing, move the policy to `p=quarantine` (suspicious mail goes to spam) and eventually `p=reject` (suspicious mail is rejected outright), which is what actually stops spoofing.
- 4DMARC depends on SPF and DKIM being correctly set up first (see the SPF guide). Fixing DMARC without those in place will just cause your own genuine mail to fail its own policy.
- 5As with SPF, this is a DNS change made wherever your domain's nameservers live.
Related checks
Want to see whether your own site passes this check, and everything else?