No DMARC record found: add one at _dmarc, start with p=none

Updated Oct 27, 2026 · Pewterkit Guides

"No DMARC record found" means nothing at _dmarc.yourdomain.com tells receiving servers what to do with mail that fails SPF and DKIM checks. Add one TXT record named _dmarc with a value such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, read the reports for a few weeks, then move to quarantine or reject. Set up SPF and/or DKIM first.

What DMARC does

DMARC builds on SPF and DKIM. Google describes the policy tag p as what "Instructs the receiving mail server what to do with messages that don't pass authentication": none (just report), quarantine (treat as spam) or reject.

Gmail's sender guidelines require DMARC from anyone sending 5,000 or more messages a day to Gmail accounts, and add that "Your DMARC enforcement policy can be set to none." For smaller senders it's still the record that stops others sending mail that pretends to be you.

Add the record

  1. Check SPF and DKIM first. Google: "Allow 48 hours after setting up SPF and/or DKIM before setting up DMARC." See no SPF record found.
  2. Create a TXT record at your DNS provider. Name: _dmarc (Google: the host "should be _dmarc.example.com"). Value:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
  1. Use a mailbox that exists for rua. Google: "The rua tag is optional but Google recommends you always include it." Reports arrive as daily XML files; a free DMARC report reader makes them readable.
  2. Look it up: dig +short TXT _dmarc.yourdomain.com should show one line starting v=DMARC1.
  3. Tighten later. Google: "When you start using DMARC, we recommend setting the policy option (p) to none." When the reports show all your real mail passing, move to p=quarantine, then p=reject.

Mistakes to avoid

  • Two DMARC records at _dmarc. Keep one.
  • No p= tag. v and p are both required, per Google.
  • Jumping straight to reject before every sender (your app's email service, newsletter tool, help desk) passes SPF or DKIM with your domain. Real mail would be refused.

What Pewterkit Check looks at

For an app on its own domain, the check reads the TXT record at _dmarc.<your domain>. It reports a fix when there's no DMARC record, when there's more than one, or when the record has no policy (p=), and shows the policy when one is set. A DNS lookup that fails never becomes a finding.

FAQ

Does p=none protect anything?

It starts the reports, so you can see who sends mail as your domain, and it meets Gmail's DMARC requirement for bulk senders. Moving to quarantine or reject is what tells receivers to act on fakes.

Do I need DMARC if I send very little email?

It's worth the one record. Receivers read it for every message, and it helps stop others faking your address.

Where do I put the record if my app sends from a subdomain?

The record at _dmarc.yourdomain.com usually covers them: RFC 7489 says receivers fall back to the main ("Organizational") domain's record, and that without an sp= tag "the policy specified by the "p" tag MUST be applied for subdomains."

Sources

  1. Set up DMARC (Google Workspace Admin Help) — read 27 Oct 2026
  2. Email sender guidelines (Gmail Help) — read 27 Oct 2026
  3. RFC 7489: DMARC (sp tag, policy discovery) — read 27 Oct 2026

How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.

Related guides