DMARC: Policy found with incorrect host name

What this means

A TXT record containing what appears to be a DMARC policy has been found with the wrong host name.

Why this is a problem

A DMARC policy should have a record name of “_dmarc”. For example, the DMARC record for example.gov.uk would be a TXT record with a fully qualified domain name of “_dmarc.example.gov.uk.”. 

If the record is named incorrectly, and no correctly named DMARC record exists, then no DMARC policy will be processed. This can affect security and deliverability of email.

How to check if the problem is there

Check your DNS zone for presence of TXT records which contain “v=DMARC1” that do not have the host name of “_dmarc”. These are often accidentally created in the root of the domain alongside the SPF record.

You might want to use the following online tools to check for this issue:

• National Cyber Security Centre’s (NCSC) check your email security tool
• Hardenize’s domain report tool

How to fix this

Ensure that your DMARC record has the correct host name beginning with “_dmarc” in your domain.

You can only have one DMARC record with a given fully qualified domain name.

If you have multiple records for the same fully qualified domain name, merge the contents as appropriate and delete the redundant record.