What is a DMARC record?
A DMARC record is a line of text in your domain's DNS that does two jobs. It tells receiving mail servers what to do with email that claims to be from you but fails the SPF and DKIM checks, and it asks them to send you reports about who is using your domain. If your domain has none, large providers can no longer assume your mail is genuine.
Last updated
The short answer
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record published at _dmarc.yourdomain.com.au. It sets a policy for mail that fails SPF and DKIM: none (monitor only), quarantine (send to junk) or reject (refuse). It also lets you receive reports. The safe way to start is v=DMARC1; p=none; rua=mailto:reports@yourdomain.com.au, read the reports for a few weeks, then move to quarantine and finally reject. Microsoft 365 does not create a DMARC record for a custom domain automatically, and since early November 2026 many small businesses have reported Outlook.com bounces where adding one was the fix.
What DMARC adds to SPF and DKIM
SPF and DKIM each check one thing, but neither tells the receiver what to do when a check fails, and neither is tied to the From address people actually see. DMARC does both. A message passes DMARC when SPF or DKIM passes and the domain it passed for matches the From domain (this is called alignment). The standard is RFC 7489.
The parts of a DMARC record
v=DMARC1
Marks the record as DMARC. It must come first.
p= (the policy)
none means monitor and deliver as normal. quarantine means treat failures as suspicious, usually the junk folder. reject means refuse them outright.
rua= (the reports)
An address that receives daily summary reports (XML files) from receivers, showing which servers sent mail as your domain and whether it passed. This is how you find forgotten senders.
Optional tags
pct= applies the policy to a percentage of failing mail while you ramp up. sp= sets a different policy for subdomains. adkim= and aspf= make alignment strict or relaxed.
Who this is for
- Businesses whose domain has no DMARC record at all.
- Anyone whose mail to Outlook.com, Hotmail, Live or MSN is bouncing with a 550 error.
- Owners who have been told to "set DMARC to reject" and are worried about blocking their own mail.
- Anyone who has had customers receive fake invoices that looked like they came from the business.
The safe path: none, then quarantine, then reject
- Check what you have. Run
nslookup -type=TXT _dmarc.yourdomain.com.au. If it says the name does not exist, you have no DMARC record. If it returns more than one line starting v=DMARC1, remove the extras. Two records invalidate each other. - Publish a monitoring record. Add a TXT record named
_dmarcwith the valuev=DMARC1; p=none; rua=mailto:reports@yourdomain.com.au. p=none blocks nothing, so it cannot stop your own mail. It does satisfy the requirement that a record exists. - Read the reports for a few weeks. The rua reports are raw XML and not pleasant to read, so many businesses use a free or low-cost DMARC report reader. Look for any legitimate sender that fails and fix it by adding it to SPF or turning on its DKIM.
- Move to quarantine. When your real mail passes consistently, change p=none to
p=quarantine. You can start withpct=25and raise it in steps. Failing mail now starts going to junk (only a share of it while pct is below 100). - Move to reject. After another clean period, change to
p=reject. Fake mail sent as your domain is now refused. Keep reading the reports, because a new service added later can start failing.
How WaTo can help
- We publish a monitoring record, read the reports with you and find every system that sends as your domain.
- We tighten the policy in stages so your own invoices and enquiries keep arriving. See email deliverability.
- If your mail to Outlook.com or Hotmail is already bouncing, we start with the 550 bounce checks.
What happens when there is no DMARC record
Without a record, receivers have no instruction from you and no way to report back. Microsoft 365's header check shows this as dmarc=none or dmarc=bestguesspass. Microsoft documents bestguesspass as meaning that no DMARC record exists for the domain, and that the message would have passed if one did. Microsoft 365 does not publish a DMARC record for your own domain for you, and neither do Google Workspace or cPanel hosting. You add it at the place your DNS is hosted.
Google has required DMARC from bulk senders (over 5,000 messages a day to Gmail) since 2024, and Microsoft's published rules for high-volume senders to Outlook.com consumer addresses also require it. Since about 5 November 2026, small senders with no DMARC record have reported bounces from Outlook.com as well. Microsoft has not published an explanation for that. The details, and what is confirmed versus reported, are in the 550 bounce guide.
Our own domain had no DMARC record. We added one and the bounces stopped. That is one case, not proof that it fixes every one.
Adding DMARC on each platform
DMARC is a DNS record, so it is added where your DNS is hosted (your registrar, your web host or a service like Cloudflare), not inside the mail platform. The mail platforms only tell you how to read the results.
Microsoft 365. Add the TXT record at your DNS host. Switch on DKIM first (see What is a DKIM record?) so DKIM can align. Microsoft's guidance is under Use DMARC to validate email.
Google Workspace. Add the TXT record at your DNS host. Google's Set up DMARC page explains the policy options and the reports.
cPanel hosting. If your DNS is in cPanel, open Zone Editor and add a TXT record named _dmarc. If DNS is elsewhere, add it there.
If the rua address is on a different domain from the one being protected, that other domain has to publish a record authorising the reports (RFC 7489 section 7.1). Using an address on the same domain avoids this.
Common DMARC mistakes
- Jumping straight to reject. If an accounting package or booking tool is not covered by SPF or DKIM, its mail starts bouncing the day you switch. Monitor first.
- Two DMARC records. Added by two different people. Keep one.
- The record in the wrong place. The name must be
_dmarcon your domain, and some DNS hosts add the domain automatically. Look it up to confirm. - DKIM not aligned. A sender signs with its own domain, so DKIM passes but does not count toward DMARC. Turn on custom-domain DKIM for it.
- SPF too long or doubled. More than 10 lookups or two SPF records break SPF, which leaves only DKIM to carry DMARC. See What is an SPF record?.
- Forwarding breaks SPF. Forwarded mail can fail SPF and pass only on DKIM. That is another reason to have both working.
- Never reading the reports. A record with p=none and no one looking at the reports does only the bare minimum.
DMARC record questions
What is a DMARC record in simple terms?
It is your instruction sheet for receiving mail servers. It says what to do with mail that claims to be from you but fails the checks, and where to send reports about it.
My domain has no DMARC record. Is that a problem?
Increasingly, yes. Google and Microsoft both expect one from business senders, and some small businesses have had mail to Outlook.com bounce until they added one. A p=none record is a safe start.
Will p=none block any email?
No. It asks receivers to deliver as normal and send you reports. It cannot stop your own mail.
How long should I stay on p=none?
Long enough to see every sender in the reports, usually a few weeks. Then move to quarantine, and later to reject if your mail passes consistently.
Is DMARC created automatically in Microsoft 365?
Not for your own domain. You add the TXT record at your DNS host yourself.
What does dmarc=bestguesspass mean?
It is a Microsoft 365 result meaning no DMARC record exists for the domain, and the message would have passed if one did.
Do I need reject, or is quarantine enough?
Quarantine already protects most customers. Reject gives the strongest protection against fake mail sent as your domain. Either is better than none.
How WaTo can help with this
Guides on this topic
- What is an SPF record?
- What is a DKIM record?
- Emails to Outlook.com or Hotmail bouncing with a 550 error
- SPF, DKIM and DMARC in plain English
- Business email security: the practical checklist
Sources & references
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- Microsoft Learn: Use DMARC to validate email
- Google Workspace Admin Help: Set up DMARC
- Google Workspace Admin Help: Email sender guidelines
- Microsoft Learn: Anti-spam message headers
- Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com
WaTo Consulting. Last reviewed 2026-11-09. Review when Google, Microsoft or Yahoo change sender requirements.
Book a call
No DMARC record, or not sure how to move past p=none safely? Book a call and have your domain name ready.
Mon to Fri, 8:30am to 5pm
