DMARC missing

Why it matters

SPF and DKIM tell whether a mail is real. DMARC tells the receiver what to do when it is not. Without it many mail servers still deliver fake mail with your domain as sender.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the DMARC record of the domain from the DNS, through Quad9 in Switzerland.

Common causes

• The record was never added
• Nobody knew it was needed
• The domain moved and the record was lost

How to fix it

1. Add a DMARC record to the DNS, starting with p=none and an address for the reports.
2. Read the reports for a few weeks to see whether all your real mail passes.
3. Then move to p=quarantine, and later to p=reject.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Receivers do not know what to do with fake mail from your domain". When everything is in order, the report says: "The domain has a DMARC policy".