Why is DMARC published at _dmarc?

DMARC uses a fixed DNS host under the domain, such as _dmarc.example.com, so receivers know exactly where to look for the policy.

What is DMARC alignment?

DMARC passes when SPF or DKIM authenticates in a way that aligns with the domain visible to the recipient. A message can have SPF or DKIM pass technically but still fail DMARC if alignment is wrong.

Should I start with p=none?

Many domains start with p=none so they can collect reports and check legitimate mail flows before asking receivers to quarantine or reject failing mail.

DMARCPROBLEM.comDMARC Record Analysis

Common DMARC Problems

DMARC failures are usually caused by missing or invalid policy records, SPF or DKIM alignment failures, incomplete third-party sender setup, forwarding paths, or enforcement being applied before all legitimate mail sources are authenticated.

Problem	What Happens	Typical Cause
No DMARC record	Domain has no DMARC protection	_dmarc.domain.com TXT record missing.
Multiple DMARC records	DMARC ignored	More than one DMARC TXT record published.
Invalid DMARC syntax	Record cannot be parsed	Missing semicolons, invalid tags, or malformed values.
Missing policy (p=)	Record invalid	Required p= tag omitted.
Invalid policy value	Record ignored	p= is not set to none, quarantine, or reject.
Policy set to none	No enforcement	Monitoring only; spoofed mail is not blocked.
Low enforcement percentage (pct=)	Partial enforcement	Policy only applied to a percentage of messages.
Missing rua address	No aggregate reports	Aggregate reporting not configured.
Missing ruf address	No forensic reports	Failure reports not configured where supported.
Invalid report address	Reports not delivered	Mailbox does not exist or is malformed.
External report destination not authorized	Reports rejected	Missing reporting authorization record.
SPF alignment failure	DMARC fails via SPF	SPF passes but Return-Path domain does not align with From domain.
DKIM alignment failure	DMARC fails via DKIM	DKIM signature valid but signing domain does not align.
Both SPF and DKIM fail	DMARC fails	Neither authentication mechanism succeeds.
SPF passes but unaligned	DMARC fails	Common with third-party senders.
DKIM passes but unaligned	DMARC fails	Vendor signs with its own domain.
Forwarded email fails DMARC	Messages may be rejected	SPF breaks during forwarding and no aligned DKIM survives.
Mailing list modifications	DMARC fails	Subject or footer changes invalidate DKIM.
Third-party sender not configured	Legitimate mail fails	CRM or marketing platform not authenticated.
Subdomain policy missing	Inconsistent protection	No sp= tag where a different subdomain policy was intended.
Strict alignment too restrictive	Legitimate mail rejected	adkim=s or aspf=s incompatible with current setup.
Relaxed alignment too permissive	Reduced protection	Does not enforce exact domain matches.
DNS lookup failure	Temporary evaluation failure	Resolver cannot retrieve DMARC record.
DNS timeout	Temporary failure	DNS infrastructure issue.
Oversized DMARC record	Parsing problems	Excessively long TXT record.
TXT formatting errors	Record ignored	Incorrect quoting or splitting.
Reporting mailbox full	Reports bounce	Aggregate reports cannot be delivered.
No report monitoring	Problems go unnoticed	Reports received but never reviewed.
Reject policy deployed too early	Legitimate mail blocked	All senders not yet authenticated.
Shadow IT senders	Unexpected failures	Unknown applications sending mail from the domain.
Vendor using own domain	Alignment failure	Messages authenticated for vendor domain, not yours.
Inconsistent authentication	Random DMARC failures	Different mail systems configured differently.
Misconfigured organizational domain	Subdomains behave unexpectedly	Public Suffix or organizational domain misunderstanding.

DMARC depends on aligned SPF or aligned DKIM. A DMARC DNS record can be syntactically valid while real messages still fail because the authenticated domain does not align with the visible From domain.

Best Practices

Publish exactly one DMARC record.
Start with p=none while monitoring reports.
Progress to quarantine, then reject once all legitimate mail sources are authenticated.
Configure both SPF and DKIM so DMARC does not depend on a single mechanism.
Use aggregate (rua) reports and review them regularly.
Consider ruf reports if supported and appropriate for your privacy requirements.
Authenticate every legitimate sender, including marketing platforms, CRMs, ticketing systems, scanners, and cloud services.
Use strict alignment only after verifying all senders are compatible.
Keep DNS records well-formed and monitor them after any changes.
Group findings into Record Errors, Policy Issues, Authentication Issues, Reporting Issues, Delivery Issues, and Best Practice Warnings so the seriousness of each issue is clear.

These categories help distinguish between critical failures where mail will not authenticate, configuration problems where the record is invalid, deployment issues where legitimate mail may fail, and recommendations that improve security and visibility.