DMARC tells receiving mail servers what to do with email that claims to come from your domain but fails SPF and DKIM checks. Without it, spoofed email is harder to stop, and Gmail and Yahoo require it of anyone sending them bulk email.
What it means
A DMARC record is a TXT record at _dmarc on the domain, starting with v=DMARC1. Its policy, p=none, p=quarantine or p=reject, says whether failing email should be delivered, sent to spam or refused. Even p=none helps, because it turns on reports showing who sends email as your domain.
What triggers it
Once a day the DNS & email security check looks up the TXT records at _dmarc on the registered domain through public DNS. If none starts with v=DMARC1 and the domain has MX records, so it receives email, this Medium issue is raised. It shows in the app and isn’t emailed.
Any DMARC record clears it, including one with p=none. The website’s Website health section shows the policy found.
Common causes
- Email was set up with SPF, and perhaps DKIM, but DMARC was never added.
- The record was added at the wrong name, such as on the domain itself instead of at _dmarc.
- The record was lost when DNS moved to a new provider.
How to fix it
- Make sure SPF is right first, and DKIM is switched on if your email provider offers it. See SPF record problem.
- At your DNS provider, add a TXT record named _dmarc with a value such as v=DMARC1; p=none; rua=mailto:dmarc@example.com, using a mailbox on your domain that someone reads.
- Read the reports for a few weeks to confirm that all your genuine email passes, then tighten the policy to p=quarantine and later p=reject.
When it clears
The issue disappears after the next daily check that no longer finds the problem, and its action drops off the action plan 7 days later.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.