Skip to content
ProfitTool
Back to all articles
Privacy & Security
1 min read

How to Fix a DMARC Record: Common Errors and Solutions

DMARC misconfigurations can cause legitimate email to be rejected or leave your domain unprotected. This guide covers the most common DMARC errors and how to fix them.

ProfitTool Team

Security & Dev

Check Your DMARC Record First

Before fixing anything, look up your current DMARC record with our DMARC Checker to see exactly what is published.

Error 1: No DMARC Record Found

Problem: _dmarc.yourdomain.com has no TXT record. Fix: Add a TXT record at _dmarc.yourdomain.com with at minimum:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Start with p=none to monitor without enforcement.

Error 2: Multiple DMARC Records

Problem: Two or more TXT records at _dmarc.yourdomain.com starting with v=DMARC1. Fix: Delete all but one. Multiple DMARC records cause a PermError — the policy is effectively not enforced.

Error 3: SPF or DKIM Alignment Failure

Problem: DMARC passes require that SPF or DKIM aligns with the visible From domain. If you send from a subdomain but your From header uses the root domain, alignment may fail. Fix: Check that the domain in your DKIM d= tag or SPF MAIL FROM matches (or is a subdomain of) the From header domain. If using relaxed alignment (the default), subdomains align with the parent domain.

Error 4: p=none With No Reporting

Problem: p=none with no rua= tag means you get no data and provide no protection. Fix: Add rua=mailto:dmarc@yourdomain.com to receive aggregate reports. Without reports, p=none provides zero value.

Error 5: pct Less Than 100

Problem: pct=50 means only 50% of messages are subject to the policy. Fix: Once you have verified your sending sources are legitimate, set pct=100 or remove the tag entirely (defaults to 100).

Error 6: Strict Alignment Breaking Forwarding

Problem: adkim=s or aspf=s with strict alignment breaks forwarded email. Fix: Use relaxed alignment (adkim=r; aspf=r) — this is the default and sufficient for most deployments.

Error 7: p=none Forever

Problem: Staying at p=none indefinitely provides no protection — spoofed emails are delivered normally. Fix: Review your aggregate reports, identify all legitimate sending sources, ensure they all pass SPF and/or DKIM, then progressively move to p=quarantine then p=reject.

Tags:#dmarc#email security#dns#email deliverability

ProfitTool Team

Security & Dev

Written and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.