Fix guide 2 min read

DMARC policy missing or too weak

Why DMARC matters for sender trust and how to add a safe policy without breaking legitimate mail.

By Sendlander editorial team Published August 20, 2026 Last reviewed August 20, 2026 Technical review: Sendlander deliverability team

Use the steps for your setup.

Get SPF or DKIM aligned first, publish a monitoring policy, inspect reports, and enforce gradually without blocking legitimate mail.

Finding: AUTHENTICATION.DMARC
Reviewed: 2026-08-21

Before you change anything: Do not jump straight to p=reject on a domain with unknown senders. DMARC enforcement is safe only after legitimate sources pass aligned SPF or DKIM.

1. Fix it in the sending platform

Where was the failed email sent from?

Google Workspace

Finish Google Workspace SPF and DKIM first, then publish DMARC at the DNS host for the From domain.

1
Confirm Google Workspace messages pass aligned SPF or DKIM for the custom From domain.
2
Inventory any non-Google products that also send from the domain and authenticate them before enforcement.
3
Publish a p=none monitoring record with an aggregate-report mailbox, review reports, then move gradually toward quarantine or reject.

Open the official instructions

2. Publish the DNS records

Where is this domain's DNS managed?

Cloudflare

Publish the exact record supplied by your sending platform in Cloudflare DNS.

1
Open the domain in Cloudflare, then go to DNS → Records and choose Add record.
2
Choose the record type shown by your sending platform and paste the supplied name and value exactly.
3
For email-authentication CNAME records, use DNS only rather than the orange-cloud proxy, then save.

Open the official instructions

3. Prove DMARC is fixed

Check both the policy in DNS and alignment on a new production-path message.

1
A single valid TXT record resolves at _dmarc.your-domain with the intended policy and report address.
2
A new message passes DMARC because SPF or DKIM aligns with the visible From domain.
3
A fresh Sendlander test clears the finding before you increase enforcement.

Run the verification test

Why this matters

DMARC tells mailbox providers how your domain expects SPF and DKIM to align. A missing or weak policy does not automatically send mail to spam, but it removes an important sender-identity signal.

When a placement report warns about DMARC, treat it as a setup issue before you spend time rewriting copy. Authentication problems affect every campaign that uses the same domain.

How to fix it

Create a TXT record at _dmarc.yourdomain.com. A cautious starting point is v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Move to quarantine or reject only after you know legitimate mail passes alignment.

Check that your actual sending platform signs DKIM with an aligned domain or passes SPF with an aligned return-path domain. Then rerun the same placement test.