What are common errors in DMARC records?

DMARC records are finicky. One typo and your reports disappear or authentication fails. Here's what breaks most often.

Publishing location is the biggest mistake. Your DMARC record must live at _dmarc.yourdomain.com, not yourdomain.com. The underscore prefix matters. Even big companies get this wrong on first try. If you publish at the root, mailbox providers won't find your policy.

Reporting addresses come next. The rua= tag (aggregate reports) needs a valid mailto address. A lot of people forget the 'mailto:' prefix, writing rua=reports@example.com instead of rua=mailto:reports@example.com. Without it, the DNS parser chokes. Also, that email address needs to be able to receive reports. If you use an external service (like a DMARC monitor), make sure they've authorized your domain first, or reports will bounce.

Tag syntax is strict. Each tag must end with a semicolon. Values can't have spaces around equals signs (it's rua=, not rua =). Misplaced or missing semicolons break the entire record. A single stray space between 'p' and '=' will cause validation failures.

Required tags matter. You need at least v=DMARC1 and p= (policy). You can't skip these or add invented tags. Some people add tags that don't exist or spell standard tags wrong (like polic= instead of p=).

Domain owner verification on report addresses. If you're sending aggregate reports to an external domain, that domain must verify it's okay. Most DMARC monitoring services handle this for you, but if you're sending to a domain you don't own, the reports will be rejected silently. You won't see an error; the reports just vanish.

Use Review My Emails's DMARC Parser to validate your record before publishing. It'll catch syntax errors instantly. If you're stuck on DNS setup, the Review My Emails SOS team can walk you through it. Test your record, then publish it live. See also: DMARC record setup. See also: how DMARC works.