Scan rule · RSC-SEC-085
No DMARC record
Checks whether an existing SPF record is paired with a DMARC record that says what should happen to forged mail.
Why this matters
SPF alone is half an answer: it tells receivers which servers may send for you, but not what to do with a message that fails the check. That is exactly what DMARC defines — deliver, quarantine or reject. Without DMARC every receiver decides for itself, and most deliver when in doubt.
DMARC also gives you something SPF cannot: reports. You learn who sends mail in your name — including the services you forgot about (newsletter tool, CRM, invoicing). That is why you start with `p=none`, read along for a few weeks and then tighten the policy.
Check it yourself: `dig TXT _dmarc.your-domain.com +short` — if no line with `v=DMARC1` comes back, the record is missing.
Scan tier
How to fix it
Publish a DMARC record at `_dmarc.<domain>` — start with `v=DMARC1; p=none; rua=mailto:…`, then raise to `p=quarantine` or `p=reject` once the reports look clean.