DMARC policy published

What this means

Passing means a TXT record at _dmarc.YOUR_DOMAIN tells receivers what to do with mail that fails SPF and DKIM alignment (quarantine it or reject it) and where to send the daily reports. Failing means there is no record, or the record exists but enforces nothing. A policy of p=none only observes; it does not protect the name.

How we test it

We run a TXT lookup at _dmarc under your domain. A record with v=DMARC1, a policy of p=quarantine or p=reject, and a rua=mailto: reporting address is a pass. A record with p=none, or one with no rua= address, is a warn. No record is a fail. This is a passive check.

Why it matters

DMARC is what inbox providers check first in 2026. Without a policy your name can be spoofed by anyone, and receivers treat mail from the domain with suspicion, including the sign-in codes and receipts your product depends on. The reporting address is not optional: the aggregate reports sent to rua= are how you learn whether a legitimate sender is failing alignment, and they are the evidence the kit asks for before moving to p=reject after 30 clean days.

The fix

Add one TXT record at _dmarc (host part only; Cloudflare appends the zone) with the value v=DMARC1; p=quarantine; rua=mailto:dmarc@YOUR_DOMAIN; pct=100, and make sure dmarc@YOUR_DOMAIN forwards to an inbox you read, for example through Cloudflare Email Routing. Start at p=quarantine if Resend is your only sender, or at p=none for 14 days first if other systems already send as the root, and change to p=reject after 30 days of clean reports.

The full runbook is in the Fix Kit, Module 08.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change any DNS record. Run: dig +short TXT _dmarc.YOUR_DOMAIN and show me the output.
If it is empty, say so: the domain publishes no DMARC policy.
If present, print the p= value, the rua= address, and any sp=, adkim=, aspf= or pct= tags.
Tell me whether p= is none, quarantine or reject, and whether the rua= address is on a domain with MX records (run dig +short MX for that domain).
Run: dig +short TXT YOUR_DOMAIN | grep spf1 and dig +short TXT resend._domainkey.YOUR_DOMAIN, and tell me whether SPF and DKIM exist for the policy to align with.
Tell me what it would take to reach p=quarantine with a working report address, and stop there.
Finally run: dig +short TXT _dmarc.YOUR_DOMAIN | grep -cE "p=(quarantine|reject)" and show the count. Expected 1.