Run dig TXT _dmarc.example.com (replace example.com with your domain). A valid DMARC record returns a single TXT starting with v=DMARC1. If the checker says "DMARC record not found" or "no DMARC record," the TXT is missing, on the wrong host, the wrong type, or not yet visible to public resolvers. Publish a monitoring record first, confirm it, then tighten policy later.
Why Checkers Report No DMARC Record
Receivers and checkers look for exactly one valid TXT record at the precise hostname _dmarc.yourdomain.com. The value must begin with v=DMARC1. A record at the apex (yourdomain.com), a CNAME instead of TXT, a typo in the host, duplicate records, or syntax errors make the record invisible. Propagation can also lag—check both your authoritative nameservers and public resolvers such as 1.1.1.1 and 8.8.8.8.
Where the Record Must Live and What to Publish
The host is always _dmarc plus your domain (or organizational domain). Record type must be TXT. A safe first record for monitoring is:
v=DMARC1; p=none; rua=mailto:[email protected]This tells receivers to take no action on failures while sending aggregate reports to the rua address. Google and Yahoo bulk-sender guidelines accept at least p=none for bulk senders; stricter policies come after you confirm alignment. Do not start with p=reject.
Three Most Common Placement Mistakes
- Publishing the TXT at the apex instead of
_dmarc.domain. Apex records are ignored for DMARC. - Using CNAME or the wrong record type. Only TXT is valid.
- Typos, extra spaces, missing semicolon, or more than one DMARC TXT. Exactly one clean record is required.
How We Analyzed This
We cross-checked ArawaMail documentation (Enable Sending adds DKIM CNAMEs and MAIL FROM SPF/MX only; it does not publish or manage DMARC), the current DMARC specification (RFC 9989, which replaced RFC 7489 in May 2026) for the _dmarc host and v=DMARC1 syntax, and Google's sender guidelines, which set the bulk-sender expectation that a DMARC record of at least p=none is expected. Verification is done with dig against public resolvers after DNS propagation.
Does ArawaMail Publish DMARC for You?
No. When you activate sending, ArawaMail configures DKIM and the custom MAIL FROM domain records via Cloudflare. You must add and manage the _dmarc TXT yourself. After the monitoring record is live, review alignment and reports.
Related reading: SPF, DKIM, and DMARC explained, DMARC alignment is the whole game, and How to read DMARC reports.
FAQ
Why does the checker say no DMARC when I added a TXT?
Most often the record is on the wrong host (apex instead of _dmarc), wrong type, has a syntax error, or has not propagated. Query public resolvers directly.
What is the safest first DMARC record?
v=DMARC1; p=none; rua=mailto:[email protected] at _dmarc.yourdomain.com.
How do I confirm the record is visible?
Run dig TXT _dmarc.yourdomain.com @1.1.1.1 and @8.8.8.8. You should see exactly one v=DMARC1 TXT.
Can I move from p=none to stricter policies later?
Yes. Collect reports first, fix alignment issues, then raise the policy. See the alignment and reports guides for next steps.