No DMARC record found: what to add
A checker says "No DMARC record found". What that means, the record to add for Google Workspace, Microsoft 365 or no mail at all, and where to put it.
Updated 20 Oct 2026. About 2 minutes to read.
When a checker (ours included) says "No DMARC record found", it asked DNS for a TXT record at _dmarc.yourdomain.com and got nothing back that starts with v=DMARC1. So mail servers have no instruction from you about fake mail in your name, and most of them just deliver it. There is a second cost if you send newsletters: since February 2024 Gmail and Yahoo want a DMARC record from anyone sending them more than 5,000 messages a day.
Which record to add
That comes down to one question. Does anything send email from this domain?
| The domain | Name | Value |
|---|---|---|
| Sends mail (Google Workspace, Microsoft 365, a newsletter tool, the shop) | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
| Sends no mail at all | _dmarc | v=DMARC1; p=reject; |
If it sends mail, you start at p=none on purpose. Yes, fakes still get through at that level. What you get is a daily report at the rua= address listing every server that sent as your domain, and after two to four weeks of those you will know whether your invoicing tool or old CRM would break under a strict policy. Then go to p=quarantine, and later p=reject. More on that step.
If it sends no mail, there is nothing to break. Use reject straight away, and add the SPF and null MX records from the no-mail lockdown while you are in there.
Where to add it
The record goes wherever your DNS is hosted. People often look at the registrar first, and that is the wrong place if the domain's nameservers point somewhere else (Warnwell prints the DNS host for each domain, which saves the guessing). The record type is TXT and the name is just _dmarc.
About that name: most DNS panels stick your domain on the end for you. Type the whole _dmarc.yourdomain.com and some of them save _dmarc.yourdomain.com.yourdomain.com, which no mail server will ever ask for. If a checker still says the record is missing an hour later, look for that first.
- Cloudflare: DNS, Records, Add record, type TXT, name _dmarc.
- GoDaddy: My Products, then DNS next to the domain, Add New Record.
- Microsoft 365 when Microsoft hosts your DNS: the admin center, Settings, Domains, pick the domain, DNS records.
- Google Workspace hosts no DNS. The Admin console tells you what to add, and you add it at your DNS host.
Mistakes we see
- The record on the domain itself (name @). It has to be on _dmarc.
- Two DMARC records, usually one from the email provider's setup wizard and one from a consultant. Receivers then ignore both of them.
- A rua= address on some other domain. That domain has to publish an extra record allowing it, or the reports never arrive, so pick an address on the same domain if you have one.