DMARC is a DNS record that tells receiving mail servers what to do with email that fails SPF or DKIM checks, and where to send reports about it. Start in monitor mode (`p=none`) for a couple of weeks to see what mail is sending as your domain, then move to an enforcing policy.
Why it matters
Without DMARC, SPF and DKIM exist but nothing tells receiving servers what to do when a message fails them, so spoofed mail using your domain can still land in someone's inbox looking legitimate.
A DMARC record present but set to `p=none` (monitor only, the default when first set up) reports on failures but does not stop them. It is a necessary first step, not the finished job.
Mailbox providers increasingly weight DMARC enforcement when deciding whether to trust mail from a domain at all, which affects deliverability for your genuine invoices, quotes and replies, not just for blocking impersonators.
How AuditCrow checks this
AuditCrow looks up the `_dmarc` TXT record for the domain, confirms it exists and is syntactically valid, and reads its policy (`p=none`, `p=quarantine`, or `p=reject`) as part of a wider window-scored assessment rather than a single pass or fail.
How to fix it
- 1Add a TXT record at `_dmarc.yourdomain.com` starting `v=DMARC1;`. A safe starting point is `v=DMARC1; p=none; rua=mailto:you@yourdomain.com;`, which only monitors and reports, changing nothing about delivery yet.
- 2Watch the aggregate reports (the `rua` address) for a couple of weeks to confirm every legitimate mail source you use is passing SPF or DKIM.
- 3Once you are confident nothing legitimate is failing, move the policy to `p=quarantine` (suspicious mail goes to spam) and eventually `p=reject` (suspicious mail is rejected outright), which is what actually stops spoofing.
- 4DMARC depends on SPF and DKIM being correctly set up first (see the SPF guide). Fixing DMARC without those in place will just cause your own genuine mail to fail its own policy.
- 5As with SPF, this is a DNS change made wherever your domain's nameservers live.
Fix it on your platform
How to fix it on Google Workspace
- If Google Workspace is your only sender, your SPF value is v=spf1 include:_spf.google.com ~all.
- About 48 hours after SPF is live, add a DMARC record at _dmarc with v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk.
Source: Set up SPF · Last checked
How to fix it on Microsoft 365
- If Microsoft 365 is your only sender, your SPF value is v=spf1 include:spf.protection.outlook.com -all.
- Add a DMARC record at _dmarc with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk.
Note: Microsoft 365 has no screen for this: add both records at your DNS host.
Source: Set up SPF to identify valid email sources for your Microsoft 365 domain · Last checked
How to fix it on Cloudflare
Where: DNS > Records > Add record
- In the Cloudflare dashboard open your domain, go to DNS > Records and select Add record.
- Add a TXT record with Name @ and your SPF value, keep Proxy status as DNS only, and save.
- Add another TXT record with Name _dmarc and your DMARC value.
Source: Set up Google Workspace DNS records · Last checked
How to fix it on GoDaddy
Where: Domain Portfolio > your domain > Domain Settings > DNS > Add New Record
- In your GoDaddy Domain Portfolio open the domain, then select DNS.
- Select Add New Record, choose TXT, set Name to @ and Value to your SPF value.
- Add a second TXT record with Name _dmarc and your DMARC value, then save.
Note: If there's already an SPF record, edit it instead of adding another.
Source: Add a TXT record · Last checked
How to fix it on IONOS
Where: Domains & SSL > Actions > DNS > Add Record
- In IONOS go to Domains & SSL, click the gear symbol under Actions for your domain and choose DNS.
- Edit the existing SPF record if there is one, or click Add Record, choose TXT, set Host name to @ and add your SPF value.
- Add another TXT record with Host name _dmarc and your DMARC value, then save.
Note: IONOS adds its own SPF record by default for IONOS-hosted domains: add other senders to that one.
Source: Managing TXT Records · Last checked
How to fix it on 123 Reg
Where: Control Panel > Manage All > your domain > DNS > Add New Record
- In the 123 Reg Control Panel select Manage All next to Domains, pick your domain, then select DNS.
- Select Add New Record, choose TXT, enter @ as Name and your SPF value as Value, then save.
- Add a second TXT record with Name _dmarc and your DMARC value.
Note: These only take effect if the domain uses 123 Reg's nameservers.
Source: How do I set up a TXT record on my domain name? · Last checked
How to fix it on any other website
- At your DNS host, add one TXT record at your domain root listing every sender, e.g. v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.
- Add a TXT record at _dmarc.yourdomain.co.uk with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk.
Note: SPF breaks on stray spaces and typos, so re-check the published record.
Source: Create and iterate an SPF record · Last checked
Related checks
Want to see whether your own site passes this check, and everything else?