Finding: DMARC Record Has No Usable Policy Tag
This finding means your domain publishes a DMARC record, but its p= tag is missing or is not one of none, quarantine, or reject. Receivers ignore the record entirely despite it being present.
Last updated August 11, 2026.
What it means
A DMARC record's p=tag states the domain owner's requested policy for mail that fails authentication, and it must be one of exactly three values. Nivaronix found a record beginning with v=DMARC1, but its p= tag was either absent or set to something outside those three values.
Why it matters
A DMARC record without a valid policy tag is not a weaker policy — it's no policy at all. Receivers checking DMARC ignore a record they can't parse a valid p= from, exactly as if none were published. This usually comes from a typo when the record was hand-edited, or a tag order or syntax mistake (for example, missing the semicolon that separates p= from the previous tag).
What Nivaronix checks
Nivaronix performs a live TXT lookup at _dmarc.<your-domain>, isolates the record beginning with v=DMARC1, and parses its p= tag. This finding fires when that tag is missing or its value is not none/quarantine/reject.
Example evidence (illustrative — not live scan data)
TXT _dmarc.example.com: v=DMARC1; rua=mailto:[email protected]
How to fix it
- Open the TXT record on the
_dmarcsubdomain at your DNS host. - Correct it to include a valid
p=tag — start atp=noneif you haven't yet confirmed all senders, orp=quarantine/p=rejectif you have. - Check the record's syntax carefully: tags are separated by semicolons, and the record must still begin with
v=DMARC1.
v=DMARC1; p=quarantine; rua=mailto:[email protected]
How to verify the fix
Re-run the SPF & DMARC checker and confirm it now reports a valid policy.