“No DMARC record found” means your domain has no DMARC policy published in DNS. Receiving servers get no instruction for mail that fails authentication from your domain.
If you send from that domain, especially at volume, that gap now costs you delivery. Here’s what the error means, how to publish a valid record in about ten minutes, and whether you need one at all.
What “No DMARC Record Found” Means
A DMARC record is a TXT record published at _dmarc.yourdomain.com. It carries two instructions for receiving servers.
How should they handle mail that fails SPF and DKIM while claiming to be from your domain? And where should they send reports? If that record is missing, neither question has an answer.
Think of it as the instruction note pinned above the mail room door. The room still runs without it. Nobody left instructions.
A checker reporting this isn’t guessing, and it hasn’t failed. It asked public DNS for a TXT record at _dmarc.yourdomain.com, got nothing back, and told you so.
Run that query yourself and you’ll get the same answer, which makes this a factual finding rather than a tool error.
What it doesn’t mean: that your mail is blocked today. Plenty of domains with no DMARC record deliver mail normally for years, which is why this error sits unnoticed for so long.
“No DMARC Record” vs “dmarc=none”: Not the Same Thing
These two look alike and mean opposite things. Someone runs a check, sees p=none, and concludes the domain has no DMARC. It has a record. The record is in monitoring mode.
| What’s published | What receivers see | Reports | Enforcement |
|---|---|---|---|
Nothing at _dmarc | No policy to apply | None | None |
v=DMARC1; p=none | A published policy, monitoring only | Yes, when rua is set | None |
p=quarantine or p=reject | A published policy with teeth | Yes, when rua is set | Failing mail is junked or rejected |
Only the first row produces “no DMARC record found“.
So p=none is a real record, and it’s the right place to start. Google says as much in its email sender guidelines: “Your DMARC enforcement policy can be set to none.“
Microsoft’s own example of a compliant record is v=DMARC1; p=none.
One more place this bites. A dmarc=none line in a message’s Authentication-Results header usually means a p=none record did its job, not that nothing is published. Check DNS directly before you trust that header.
How DMARC Works (And Why It Needs SPF or DKIM)
Worth sixty seconds of context, because it explains most “I published a record and it still fails” cases.
SPF and DKIM do the authenticating. What an SPF record is lists the servers allowed to send for your domain. How DKIM works signs each message with a key published in your DNS.
DMARC sits on top. It checks that the domain which passed SPF or DKIM is the same domain your reader sees in the From line.
If they don’t match, your policy applies, and reports go out either way.
That matching step is called alignment, and it’s where most of the surprises live. An email platform can pass SPF perfectly and still fail DMARC, because it authenticated its own domain rather than yours.
For the full mechanism, see what DMARC is.
Do You Actually Need a DMARC Record?
Every sender benefits from one, and since 2024 bulk senders have been required to have one.
That’s the short answer. The detail matters, because the three big mailbox providers word their requirements differently, and people keep flattening them into one number.
| Provider | Who it applies to | What it requires |
|---|---|---|
| More than 5,000 messages a day to Gmail accounts | A DMARC record, p=none or stronger, with SPF or DKIM aligned to the From domain | |
| Yahoo | “Bulk senders”, with no daily figure published | DMARC passing at p=none or stronger, plus both SPF and DKIM |
| Microsoft | 5,000 or more messages to Outlook.com, Hotmail.com and Live.com | A DMARC record, p=none or stronger, with SPF or DKIM aligned |
Sources: Google’s email sender guidelines, Yahoo’s sender best practices and Microsoft’s 550 5.7.515 page, each checked in October 2026.
Two details get misquoted constantly. Google’s 5,000 is explicitly per day. Microsoft states a count without calling it daily, and Yahoo publishes no figure at all.
Microsoft has one more quirk worth knowing. With no DMARC record published, its filters can stamp dmarc=bestguesspass on your mail.
That means Microsoft inferred a pass for you, which is a guess, not something to build on.
Below those volumes nothing is mandatory. Publishing is still worth it, for spoofing protection and for the report stream that shows you who else is sending as your domain.
One note on the spec. DMARC was republished in May 2026 as RFC 9989, on the IETF standards track, with reporting split into RFC 9990 and RFC 9991.
It replaces RFC 7489, which was only an Informational document with no formal IETF standing.
Section 4.10.1 is blunt about the no-record case: “Mail Receivers MUST NOT apply the DMARC mechanism to the message.”
How to Fix “No DMARC Record Found”
Three steps, and allow up to 48 hours for DNS to propagate, though it’s usually much faster.
Step 1: Generate Your Record
The minimum viable record is one line:
v=DMARC1; p=none; rua=mailto:you@yourdomain.comThat publishes a policy in monitoring mode and asks receivers to send you reports. Nothing gets quarantined or rejected while you sit at p=none, which is why it’s the only sensible place to begin.
Prefer to fill in the blanks? Generate your record with the free DMARC generator and copy the output.
Step 2: Publish It in DNS
Add a single TXT record in your DNS provider’s panel. The fields are the same everywhere. Every panel just labels them slightly differently.
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:you@yourdomain.com |
| TTL | Default, or 3600 |
Where that form lives, by provider:
- Cloudflare: DNS, then Records, then Add record, type TXT.
- GoDaddy: Domain Settings, then DNS, then Add New Record.
- Squarespace, which absorbed Google Domains: Domains, then DNS, then DNS Settings.
- cPanel: Zone Editor, then Manage, then Add Record.
One trap here: some registrars append your domain to whatever you type in the Host field.
Where that happens, entering _dmarc.yourdomain.com creates _dmarc.yourdomain.com.yourdomain.com, and nothing will ever find the record. Enter _dmarc on its own, then read back what saved.
Step 3: Verify It Worked
Don’t simply re-run a checker. A checker can pass a record that receivers discard, which is the most common reason this error seems to persist after a fix. Check it the way a receiver would:
- Exactly one TXT record comes back at
_dmarc, with no CNAME sitting next to it. - The value begins
v=DMARC1, with no leading space. - The host hasn’t been doubled.
- Send yourself a real message and read its Authentication-Results header for
dmarc=pass.
Seeing p=none at this point is success, not the old error. The record is live, receivers can read it, and aggregate reports should start arriving within a day or two.
Can You Set Up DMARC Without SPF or DKIM? (And Without rua)
Technically yes. Usefully, no.
DMARC only passes when SPF or DKIM passes and aligns with your From domain. Publish a DMARC record with neither in place and every message fails the check.
At p=none that’s harmless. Nothing gets enforced. At p=reject you’ve instructed the world to refuse your own mail.
So publish at least one of them first. Both is better: SPF covers the sending server, DKIM survives forwarding. You can publish an SPF record and set up DKIM in a few minutes each.
Starting all three from scratch? Follow the full SPF, DKIM and DMARC setup walkthrough.
The rua tag is genuinely optional. Leave it out and your policy still applies, but no reports come back. You’re enforcing blind, with no idea who is sending as you or what’s failing.
What Happens After Setup: The Policy Ladder
p=none isn’t the destination. It’s the first rung.
Four moves, in order.
- Start at
p=none: Nothing is enforced, and reports start arriving. - Read the reports: Find every legitimate sender using your domain, then get SPF or DKIM aligned for each one.
- Move to
p=quarantine: Failing mail lands in spam rather than the inbox. Give it a week or two. - Then
p=reject: Failing mail is refused outright.
Why not jump straight to reject? Because you’ll block legitimate senders you haven’t authenticated yet. The invoicing tool, the CRM, the help desk nobody remembers is sending on your behalf.
Keep reading reports after you arrive, because enforcement turns somebody else’s quiet breakage into your outage.
Expect the climb from none to reject to take a few months, because rushing leads straight to a rollback.
What DMARC Will Not Fix: Your Inbox Placement
Here’s the part most DMARC vendors leave out.
DMARC authenticates your domain and stops other people spoofing it. It does not, on its own, land your mail in the inbox.
Those are two different problems. Authentication answers “is this really from you?”. Placement answers “do we want it?”.
A perfectly authenticated message from a domain with no sending history still goes to spam.
Placement depends on sender reputation, recipient engagement, list quality, and whether the domain and its mailboxes have been warmed up properly.
So treat DMARC as the entry ticket. It gets you considered. The reputation work is separate, and that’s the part deciding where you actually land.
Watch your spam rate in Google Postmaster Tools, which Google asks bulk senders to keep below 0.30%.
If placement is the real problem, warm up your sending domains before you scale sending. TrulyInbox warms your domain and every mailbox on a network of 50,000+ real inboxes.
Still Seeing the Error? Match the Symptom to the Cause
| Symptom | Likely cause | What to do |
|---|---|---|
| Error persists right after publishing | DNS hasn’t propagated yet | Wait, up to 48 hours |
Record found at the root but not at _dmarc | Published to the wrong host | Republish with the host _dmarc |
_dmarc.yourdomain.com.yourdomain.com in your zone | Registrar appended your domain | Enter _dmarc on its own |
Two records returned at _dmarc | Usually a CNAME delegation plus a later one-click setup | Remove one, leave exactly one |
| Checker passes on the root, fails on a subdomain | A direct lookup at the subdomain is empty | Normally fine, see below |
| Record present but reported invalid | Syntax: a smart quote, a leading space, a missing v=DMARC1 | Retype the value as plain text |
Two of those deserve more than a table row.
RFC 9989 section 4.10 is unambiguous about duplicates:
“If multiple DMARC Policy Records are returned for a single target, they are all discarded.”
So two records at _dmarc doesn’t mean one of them wins. It means the domain has no working DMARC at all. That’s worse than where you started.
Section 4.10 is just as blunt about syntax:
“Records that do not start with a v tag that identifies the current version of DMARC are discarded.”
One leading space does it.
Subdomains and Non-Sending Domains
A subdomain with no record of its own inherits the organisational domain’s policy automatically. The sp tag doesn’t switch that inheritance on.
Per RFC 9989 section 4.7, sp overrides what existing subdomains inherit, and np sets the policy for subdomains that don’t exist.
So a direct check on mail.yourdomain.com coming back empty is normal, because receivers still apply the root policy.
The real subdomain trap is alignment. Microsoft’s guidance is explicit: each subdomain needs its own SPF and DKIM records for DMARC to pass. An inherited policy with neither in place fails every message from that subdomain.
For a domain you never send from, publish v=DMARC1; p=reject; and lock it down.
Want the rest of the checks in one place? Run the deliverability checklist.
Frequently Asked Questions
1. Do I Actually Need a DMARC Record?
If you send more than 5,000 messages a day to Gmail, yes, Google requires one. Yahoo and Microsoft have their own bulk-sender rules. Below those volumes it isn’t mandatory.
Publish one anyway. It stops people spoofing your domain and gives you reports on who is sending as you.
2. Is “dmarc=none” the Same as No DMARC Record?
No, and the difference matters. A dmarc=none header almost always means you have a record published at p=none, which is monitoring mode and a perfectly valid policy.
A missing record produces a different result: no DMARC evaluation at all. When the header looks ambiguous, query _dmarc.yourdomain.com directly.
3. Can I Set Up DMARC Without SPF or DKIM?
You can publish the record, but it won’t do anything useful. DMARC passes only when SPF or DKIM passes and aligns with your From domain.
With neither in place, every message fails. At p=reject that means your own mail gets refused, so set up at least one first.
4. How Long Does a DMARC Record Take to Work?
Publishing is immediate. DNS propagation usually takes minutes, though it can stretch to 48 hours.
Protection builds more slowly. At p=none nothing is enforced, so you’re collecting reports rather than blocking anything until you move up to quarantine or reject.
5. Why Do I Still See “No DMARC Record Found” After Publishing?
Usually one of four things. The record went to the wrong host. Your registrar appended your domain to the name. Two records are returned at _dmarc, so receivers discard both.
Or the value doesn’t begin with v=DMARC1. Check all four, then allow up to 48 hours.
6. Does DMARC Improve Inbox Placement?
Not on its own. DMARC authenticates your domain and stops spoofing, which protects your reputation, but it doesn’t decide which folder your mail lands in.
Placement comes from sending reputation, engagement and whether your domain and mailboxes are warmed. Authentication is the entry ticket, not the whole job.
