DMARC Checker: What "No DMARC Record Found" Means and How to Fix It

If a DMARC checker says "No DMARC record found," receiving mail servers have no instructions for email that fakes your domain, and you get no reports about who is sending as you. Gmail and Yahoo have required DMARC from bulk senders since 2024, so it's a deliverability problem too. Here's how to confirm the result and fix it.

Step 1: Check the right place

DMARC never lives on your bare domain. It's always a TXT record at _dmarc in front of the domain in your From address:

dig +short TXT _dmarc.yourdomain.com

To rule out a stale local cache, ask public resolvers directly:

dig +short TXT _dmarc.yourdomain.com @1.1.1.1
dig +short TXT _dmarc.yourdomain.com @8.8.8.8

Windows: nslookup -type=TXT _dmarc.yourdomain.com 1.1.1.1. A working record returns one string starting with v=DMARC1. Empty output means there's genuinely nothing there.

Step 2: Rule out the false "not found" results

Your DNS panel can show a record that receivers still can't use. The usual causes:

1. Wrong host name. The record was added on the root domain or on dmarc (no underscore) instead of _dmarc.
2. Domain typed twice. Many DNS hosts, including GoDaddy and Cloudflare, add your domain automatically, so entering _dmarc.yourdomain.com as the name creates _dmarc.yourdomain.com.yourdomain.com. Enter just _dmarc.
3. It doesn't start with v=DMARC1. Records missing that exact opening tag are discarded.
4. Two DMARC records. When receivers find more than one, they apply no policy at all.
5. A CNAME instead of a TXT. Some setups point _dmarc at another name. Check with dig CNAME _dmarc.yourdomain.com +short and make sure it ends at a real TXT record.

And if you added the record minutes ago, give DNS time to update before assuming it failed.

Step 3: Publish a starter record

Add one TXT record:

Name:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Use a mailbox you actually check in rua; that's where daily aggregate reports arrive. p=none is monitoring mode: nothing gets blocked, but you start seeing every service that sends as your domain.

"No record" vs. p=none

They aren't the same. With no record, DMARC isn't applied and you get zero reports. With p=none, DMARC runs, failing mail still gets delivered, and you get the reports you need to tighten things safely.

Step 4: Move toward enforcement

DMARC passes only when SPF or DKIM passes for a domain that matches your visible From address. Use two to four weeks of reports to make sure every real sender (Google Workspace, Microsoft 365, your newsletter tool, your invoicing app) passes, then change p=none to p=quarantine, and later to p=reject. Jumping straight to reject is how businesses accidentally block their own invoices.

Setting up the pieces underneath? See our SPF record checker guide and the GoDaddy DMARC walkthrough.

Check it the fast way

Want the answer without the terminal? Scan your site free with SiteShield. It checks DMARC, SPF, HTTPS, and security headers in under a minute and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free