Fix your DMARC, step by step

"No DMARC record found"

Your domain has no DMARC instruction, so inboxes have no guidance on fakes and you get no reports. Add a TXT record at _dmarc.yourdomain.com. A safe starting point is:

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

Replace the address with a mailbox that can receive reports, or use Harbour's reporting address so the reports are read for you. Use the DMARC record generator to build yours.

Syntax errors

DMARC records are strict. The most common mistakes:

• The record doesn't start with v=DMARC1 exactly, or that tag isn't first.
• Commas instead of semicolons between tags.
• A mailto: missing from the report address.
• The record is at the wrong name, for example on yourdomain.com instead of _dmarc.yourdomain.com.
• Curly quotes pasted in from a document.

Run the DMARC checker after each change; it will point at the exact problem.

More than one DMARC record

If two TXT records start with v=DMARC1, receivers treat that as no DMARC at all. This often happens when a second tool "adds" DMARC for you. Merge them into one record, keeping the stronger policy and both report addresses separated by a comma, then delete the other.

"DMARC fail" or alignment failures

DMARC passes only if SPF or DKIM passes and matches the domain in the "From" address. A service can pass SPF for its own domain and still fail DMARC for yours.

The fix is nearly always to set up DKIM signing for your own domain inside that service (look for "domain authentication" or "custom DKIM"), and to add the service to your SPF record. Harbour's reports show you which service is failing, so you know where to look.

"p=none": policy not enabled

p=none is watch mode. It's the right place to start, but it doesn't stop anyone faking your address. Once your real email passes, move to:

v=DMARC1; p=quarantine; pct=25; rua=mailto:you@yourdomain.com

and then on to p=reject. Our guide to getting to p=reject safely covers the stages.

How Harbour checks the fix

After you change a record, run the free check again. DNS changes usually show within minutes, though some hosts take up to a few hours. With monitoring switched on, Harbour also watches the next days of reports and confirms that real email still passes, so you know the fix worked in practice and not just on paper.