Why does the "DMARC record" check matter?

DMARC protects your brand against email impersonation (phishing). Without it, attackers can send fake emails to your clients in your name, destroying trust and damaging your reputation.

Domain & DNS Check n°30 / 120

DMARC record

DMARC is the conductor of email security. It tells receivers what to do if an email claims to come from your domain but fails SPF or DKIM ch…

Analyse my site for free

← All checks

What is it?

Understanding "DMARC record"

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the mechanism that sits above SPF and DKIM: it tells receiving servers what to do with an email that fails SPF and/or DKIM checks, and lets you receive aggregated reports on who is sending emails using your domain — including spoofing attempts.

Without a DMARC policy, SPF and DKIM remain mere informational signals: a receiving server can choose to ignore them and still deliver an unauthenticated email. DMARC turns these signals into an actually enforced rule.

❌ Without DMARC (p=none or absent)

📧 Spoofed email, fails SPF/DKIM

→ no enforcement policy →

📬 Delivered anyway

✅ DMARC p=reject

📧 Spoofed email, fails SPF/DKIM

→ reject policy enforced →

🚫 Rejected before the inbox

How we check it

How TheSiteFuse checks "DMARC record"

TheSiteFuse queries the TXT record _dmarc.<domain> and looks for a value starting with v=DMARC1. If found, the applied policy (p=) is extracted via regular expression. A quarantine or reject policy counts as a pass; a none policy (monitoring only, no real enforcement) triggers a warning recommending it be strengthened. A complete absence of a DMARC record also triggers a warning.

Risks if it fails

Why "DMARC record" matters

Large-scale brand impersonation — without DMARC in a strict policy, phishing campaigns can use your exact domain as the sender and be delivered normally to victims' inboxes, even if SPF or DKIM fail.
Lack of visibility — without DMARC's aggregated reports (rua=), you have no information on who is sending emails on your behalf, legitimately or fraudulently, preventing any proactive spoofing detection.
Insufficient "none" policy — many organisations stop at p=none (monitoring mode) out of caution, but this concretely blocks no fraudulent email — only quarantine and reject have a real protective effect.

How to fix

Fix "DMARC record" step by step

Step 1 — Start in monitoring mode

Name: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

This first step blocks nothing but lets you collect reports for 2 to 4 weeks to identify every legitimate service sending email on your behalf (CRM, marketing tool, ERP…) before tightening the policy.

Step 2 — Move to quarantine

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

Step 3 — Final reject policy

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

Recommendation: never jump straight to p=reject without going through the previous steps — a legitimate service forgotten in SPF/DKIM would then have its emails silently rejected, with no alert giving you time to fix it.

Learn more

Reference resource

To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.

Wikipedia — DMARC record

Does your site pass this check?

Run the free full audit (120 checks) and instantly discover what needs fixing.

Previous DKIM record Next BIMI record