DMARC record checker

What DMARC adds

SPF and DKIM each prove something about a message, but neither looks at the From address people see. DMARC does: it passes only if SPF or DKIM passes and the domain it verified matches the From domain ("alignment"). Your DMARC record then tells receivers what to do with mail that fails, and where to send reports.

_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

The three policies

• p=none: monitor only. Failing mail is delivered as usual; you just get reports. This meets the basic DMARC requirement Google and Yahoo set for bulk senders, but doesn't stop spoofing.
• p=quarantine: failing mail goes to spam.
• p=reject: failing mail is refused. The strongest protection against impersonation.

A safe path to enforcement

1. Publish p=none with a rua= address and collect reports for 2–4 weeks.
2. Use the reports to find every service that sends as your domain (your mailbox provider, CRM, billing tool, newsletter platform) and make each one pass SPF or DKIM with alignment. Usually that means setting up DKIM signing with your domain in each tool.
3. Move to p=quarantine, optionally with pct=25 at first, then 100.
4. When reports show only legitimate mail passing, move to p=reject.

Reporting addresses on another domain

If rua= points to a different domain (a reporting service, or your agency), that domain must publish a record saying it accepts your reports: yourdomain.com._report._dmarc.theirdomain.com with the value v=DMARC1. Without it, many receivers won't send reports. Reporting services usually set this up automatically; if you use your own second domain, add it yourself.

Common mistakes

• Two DMARC records: receivers ignore both. Keep one.
• Publishing at the wrong name: it must be _dmarc.yourdomain.com, not the bare domain.
• Missing semicolons between tags, or smart quotes pasted from a document.
• Jumping straight to p=reject before every sender is aligned, which blocks your own invoices or newsletters.