Finding: No DMARC Record
This finding means your domain publishes no DMARC record. Receiving mail servers have no instruction about what to do with mail that fails SPF or DKIM, and you get no visibility into who is sending mail as your domain.
Last updated August 11, 2026.
What it means
DMARC is a TXT record published at _dmarc.<your-domain> that tells receivers what to do with mail failing SPF or DKIM alignment, and where to send aggregate reports about it. Nivaronix looked up that location and found no record beginning with v=DMARC1 — none has been published at all.
Why it matters
SPF on its own only tells receivers which servers are authorized — it doesn't give an instruction for what to do with mail that fails, and different receivers make that call differently on their own. DMARC is what actually turns SPF into enforcement: it lets you state a policy explicitly and receive reports showing who is sending mail as your domain, legitimate or not. This finding is distinct from the one Nivaronix reports when a DMARC record exists but sits at its weakest policy — see DMARC Policy Is Monitoring Only (p=none) for that case.
What Nivaronix checks
Nivaronix performs a live TXT lookup at _dmarc.<your-domain> and isolates any record beginning with v=DMARC1. This finding fires when the lookup completes but no such record is found.
Example evidence (illustrative — not live scan data)
TXT _dmarc.example.com: no record beginning with v=DMARC1
How to fix it
- At your DNS host, add a TXT record on the
_dmarcsubdomain starting atp=noneto begin collecting reports without affecting mail delivery. - Point
rua=at an address or report-viewer you check regularly. - After reviewing reports and confirming all legitimate mail passes, move the policy to
p=quarantine, then eventuallyp=reject.
v=DMARC1; p=none; rua=mailto:[email protected]
How to verify the fix
Re-run the SPF & DMARC checker and confirm it now reports a DMARC record.