DMARC record is missing

What does this mean?

DMARC tells receiving mail servers what to do with email that fails your SPF/DKIM checks, and gives you visibility into who's sending mail using your domain — including spoofers. Without it, even a correctly configured SPF/DKIM setup has no enforcement behind it.

What are the potential impacts?

• Even with SPF and DKIM in place, without DMARC there's no policy telling receiving mail servers what to do when a message fails those checks, so spoofed mail is delivered anyway.
• You get zero visibility into who is sending email using your domain, meaning an active phishing campaign impersonating your company could run for months without you knowing.
• This is frequently the deciding factor in business email compromise (BEC) scams, where a spoofed "CEO" or "vendor" email requests an urgent wire transfer.