DMARC is missing or only monitoring
sec_dmarcShort answer
Publish a TXT record at _dmarc.example.com. Start with v=DMARC1; p=none; rua=mailto:dmarc@example.com to collect reports, then move to p=quarantine and finally p=reject once all your real mail passes SPF or DKIM in alignment with your domain.
Why it matters
DMARC is what links SPF and DKIM to the From: address people actually see, and it tells receivers what to do with mail that fails: deliver it (p=none), send it to spam (quarantine) or refuse it (reject). Without an enforcing policy, a phishing message that uses your exact domain in From: still reaches inboxes. Gmail and Yahoo require at least p=none from bulk senders, so that level satisfies them, but it does not protect your recipients.
There is no search ranking effect; the risk is fraud against your customers and staff in your name.
How Glimana detects it
Glimana reads the TXT records at _dmarc. plus your registrable domain through public DNS-over-HTTPS resolvers and uses the first one starting with v=DMARC1. No record is medium if the domain has MX records and low if it receives no mail. A record with p=none, or without a readable p= tag, is low (monitoring only). p=quarantine or p=reject with pct below 100 is also low, because the policy then applies to only part of the failing mail. p=quarantine and p=reject at full strength pass; the sp and alignment tags are not evaluated. If DNS could not be queried, the result is Could not be measured.
How to fix it
Watch out
Do not jump straight to p=reject. Any legitimate sender that does not pass aligned SPF or DKIM (a newsletter tool, CRM, invoicing system or the website's contact form) will have its mail rejected. Read the aggregate (rua) reports for two to four weeks, fix those senders, go through p=quarantine, then p=reject. A rua address on another domain only receives reports if that domain publishes an authorisation record; report services set this up for you.
- Find the finding in Glimana. Open Security; this check is in the E-mail and DNS group, with the evidence from the last scan under its title. The same problem is listed under Issues › DMARC is missing or only monitoring.
-
Apply the fix on your platform.
In DNS › Records click Add record: Type
TXT, Name_dmarc, Contentv=DMARC1; p=none; rua=mailto:dmarc@example.com. Cloudflare's free DMARC Management (under Email) can create the record and collect the reports for you. When reports are clean, edit the record top=quarantine, laterp=reject.Add a TXT record with host
_dmarc. Most panels append your domain automatically; entering_dmarc.example.comthere creates_dmarc.example.com.example.com. Final value, for example:v=DMARC1; p=reject; rua=mailto:dmarc@example.com. Check withdig +short TXT _dmarc.example.com.No reporting phase is needed: publish
v=DMARC1; p=reject;at_dmarctogether with the SPF recordv=spf1 -all. - Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.
How the fix is verified
After changing DNS, wait until the old record's TTL has passed, then press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.