No DMARC record
A check found no v=DMARC1 TXT record at _dmarc. plus your domain, and none at the organisational domain above it. RFC 9989 §4.10.1 is explicit about the consequence: with no record found, the DMARC mechanism is not applied to the message at all. There is no alignment requirement, nothing is enforced, and no aggregate reports reach you. This page covers where the record goes, the minimum record, and why your first should be p=none.
Measured 2026-09-09: 93 of 429 audited domains (21.7%) published no DMARC record at _dmarc.. These are domains someone had a reason to check, so this is an upper bound and not an internet-wide rate.
What was observed
A TXT lookup on _dmarc. plus your domain returned no string beginning v=DMARC1, and the tree walk up to the organisational domain found none either. Other TXT records may exist on that name; DMARC looks only for that one.
What causes it
These are protocol and measurement causes only. We do not speculate about what any particular receiver did with the result.
- The record was never published.
- It was published on the domain itself rather than on
_dmarc.— the most common mistake, because SPF does go on the domain itself. - The version tag is not
v=DMARC1, or is not first in the record, so the whole record is ignored (RFC 9989 §4.7). - The record exists on a subdomain but not on the organisational domain, or the zone moved provider and this record was not carried over.
- The name is a CNAME to a third-party DMARC host that no longer answers.
How to verify it yourself
- Read the DMARC name directly
dig +short TXT _dmarc.example.com - Filter to the DMARC record
dig +short TXT _dmarc.example.com | grep DMARC1
Check this domain Reads the live record and reports the policy it publishes.
The exact record to publish
One TXT record, on host _dmarc, with a reporting address you can actually read:
v=DMARC1; p=none; rua=mailto:dmarc@example.comWhat can break: nothing, at p=none. RFC 9989 §4.7 defines it as the Domain Owner offering no expression of preference, so it asks for no change to how mail already being delivered is handled. The risk arrives later, when you move to p=quarantine or p=reject before your reports show every legitimate sender aligned. Tighten on evidence, not on a schedule.
Examples
v=DMARC1; p=none; rua=mailto:dmarc@example.comv=DMARC1; p=reject; rua=mailto:dmarc@example.comv=DMARC1; p=reject; sp=none; rua=mailto:dmarc@example.comp=none; rua=mailto:dmarc@example.comv=DMARC1; rua=mailto:dmarc@example.comWhat the standard says
RFC 9989 §4.10.1: “If the set produced by the DNS Tree Walk contains no DMARC Policy Record … Mail Receivers MUST NOT apply the DMARC mechanism to the message.”
RFC 9989 (May 2026) obsoletes RFC 7489. Working from 7489 will mislead you on at least one point relevant to this page: it made the p tag REQUIRED, and 9989 §4.7 makes it RECOMMENDED.
What does “no DMARC record” mean?
A TXT lookup on _dmarc.example.com returned nothing starting v=DMARC1, and the DNS Tree Walk found no record at the organisational domain either. There is no DMARC Policy Record to apply.
Where exactly does the DMARC record go?
On the hostname _dmarc.example.com, type TXT. Not on the domain itself, which is where SPF goes, and not as a CNAME to somewhere you do not control.
What is the minimum valid DMARC record?
v=DMARC1; p=none. RFC 9989 §4.7 makes v REQUIRED and p RECOMMENDED. Adding rua= is what makes it useful, because without a reporting address you publish a policy and receive no data about it.
Do I need DMARC if I already have SPF and DKIM?
They answer different questions. SPF and DKIM authenticate a sending path; DMARC states an assessment policy for mail where neither authenticated identifier aligns with the Author Domain, and asks for reports. With no record there is no alignment requirement and no reporting.
Should I start at p=none or go straight to p=reject?
Start at p=none with rua= set. p=none is defined in RFC 9989 §4.7 as the Domain Owner offering no expression of preference, so publishing it asks for no handling change, and it turns on the reports that tell you which senders are not aligned. Move to quarantine and then reject once those reports are clean.
What about subdomains?
A record on the organisational domain covers subdomains unless an sp= or np= tag says otherwise. You do not need a record per subdomain, and publishing one on a subdomain overrides the parent for that name.
How long before a new DMARC record is visible?
As long as the previous negative answer is cached. If no record existed before, resolvers may hold that negative answer for the zone's SOA minimum rather than a record TTL, so check again after the SOA minimum has elapsed.
Which RFC defines DMARC now?
RFC 9989, published May 2026, which obsoletes RFC 7489 and RFC 9091. Aggregate reporting moved to RFC 9990. If you are working from 7489 some tag requirements have changed — p is RECOMMENDED in 9989 where 7489 made it REQUIRED.
What we do not claim
We report what your DNS publishes and what RFC 9989 says a conforming evaluator does with it. We do not state what any particular mailbox provider will do: those decisions are theirs, they are not published, and we cannot measure them from here.
Reviewed by Venkat Nookala, last reviewed 2026-09-09.