Email & DNS guide
How to investigate a DMARC warning
A practical sequence for missing records, duplicate policies and unexpected authentication failures.
1. Identify the exact finding
Missing DNS policy, invalid policy and failing message authentication are different problems. Save the checker output and the current DNS record. Confirm you are editing the authoritative DNS provider, which may differ from the registrar where you bought the domain.
2. Repair the record before changing enforcement
At _dmarc, check for one TXT record whose first tag is v=DMARC1 and whose p tag is a valid policy. Remove duplicate policies only after confirming which settings to preserve. Do not confuse multiple quoted chunks of one TXT record with multiple separate records.
3. Fix alignment at the sender
For each real sending service, inspect a fresh received message. Compare the visible From domain with the envelope sender and DKIM signing domain. Use the provider's custom-domain authentication settings when alignment is missing. Changing p=reject to p=none may reduce disruption, but it does not fix authentication.
4. Verify and observe
Query the record after the earlier TTL has elapsed. Review aggregate reports and test mail through each provider, including support and invoicing systems. Keep an owner and rollback record for each DNS change. Move toward enforcement only when you understand the remaining failures.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.