“No DMARC record found” means there is no TXT record at _dmarc.yourdomain.com, so receiving servers have no policy to apply and your domain can be spoofed. Fix it by publishing a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:[email protected], then tighten to p=reject once reports confirm your legitimate senders pass.
The checker queried the _dmarc subdomain of your domain and got nothing back. DMARC is not inherited and not on by default — if you have never published a record, there is none. Until you do, mailbox providers have no instruction for mail that fails authentication, which is exactly what phishing and business-email-compromise attacks rely on.
Add a DNS TXT record. The host/name is _dmarc (your DNS provider appends your domain automatically). The value is:
Leave the record at p=none for a few weeks. The rua mailbox receives daily aggregate reports listing every service sending as your domain. Authenticate the legitimate ones with SPF and DKIM, then change p=none → p=quarantine → p=reject. Only quarantine and reject actually stop spoofing.
In your DNS, create a TXT record with host _dmarc and this value:
$ v=DMARC1; p=none; rua=mailto:[email protected]After DNS propagates (minutes to an hour), confirm it:
$ dig TXT _dmarc.yourdomain.com +shortCheck your DMARC record now
Open the free DMARC checker →No — it only monitors. Your domain is protected only at p=quarantine or p=reject. Use p=none to gather data, not as the finish line.
At p=none, no — nothing is blocked. Breakage only risks happening at enforcement if a legitimate sender is not authenticated, which is why you monitor reports first.
DNS changes propagate within minutes to an hour. Reports then arrive daily, not instantly.
