No qualifying DMARC TXT record was observed
ShipReady found no TXT value beginning with v=DMARC1 in the completed DMARC lookup chain for the scanned host.
Why it matters
DMARC gives a domain a published policy that receiving systems may use when evaluating messages that claim to use the domain in their From address. Publishing an intended record is a useful part of an email-authentication rollout.
How ShipReady detects it
What it inspects
ShipReady queries _dmarc.<host> and then parent domains through the derived organisational domain, collecting TXT answers at each name.
NXDOMAIN and NoAnswer are treated as completed absence. A timeout, SERVFAIL, unreachable nameserver, or other lookup failure is inconclusive and suppresses this absence finding.
What triggers a finding
The rule triggers only when every completed lookup in that chain contains no TXT value beginning with v=DMARC1.
What the evidence shows
No qualifying DMARC TXT record was observed in the completed lookup chain used for the scanned host.
Limits of this check
ShipReady performs bounded DNS and text inspection. It does not send email, test sender alignment, query receiving providers, observe inbox or spam placement, or prove that forged or legitimate mail is delivered in a particular way.
How to fix it
Inventory intended mail senders
Identify the services and domains that legitimately send mail using this domain before choosing a DMARC policy.
Publish one deliberate DMARC record
Publish a DMARC TXT record at the appropriate _dmarc name with an intended policy and reporting destination. Start with a monitoring policy only when it fits the organisation's rollout plan.
Validate sending paths separately
Use controlled mail tests and provider reporting to verify legitimate senders before increasing enforcement.
How to verify the change
Requery the deployed DMARC name
After DNS propagation, query the DMARC name used for the domain and inspect the returned TXT answers.
Expected: The completed lookup returns one intended DMARC record beginning with v=DMARC1.