DMARC checker

What DMARC does

DMARC is a short TXT record at _dmarc.yourdomain that ties SPF and DKIM to the address in the From line. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From domain. The record then tells receivers what to do with mail that fails, and where to send reports about it.

A typical record looks like this:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

The tags that matter

• p: the policy. none only reports, quarantine sends failing mail to spam, reject refuses it.
• rua: where daily aggregate reports go. Without it you cannot see who sends as your domain.
• sp: the policy for subdomains, when it should differ from p.
• pct: the share of failing mail the policy applies to, for a gradual rollout. Leave it at 100 once you are confident.
• adkim and aspf: relaxed (r, the default) lets a subdomain match; strict (s) needs the exact domain.

Moving to enforcement safely

1. Publish p=none with a rua address.
2. Read the reports for two to four weeks and list every service that sends for you: your mail provider, newsletter tool, invoicing, help desk.
3. Make each of them pass with an aligned DKIM signature (preferably) or SPF. Check SPF with the SPF checker and keys with the DKIM lookup.
4. Move to p=quarantine, watch the reports, then p=reject.

For background on how these records fit together, see business email on your own domain, explained.

Questions

Which DMARC policy should I use?

Start with p=none and a rua address so you receive reports without affecting delivery. When the reports show that every service that sends for you passes SPF or DKIM in alignment, move to p=quarantine, and later to p=reject. Most domains get there in a few weeks.

Do I need DMARC if I already have SPF and DKIM?

Yes. SPF and DKIM on their own do not check the From address people see, and they do not tell receivers what to do when a check fails. DMARC does both. Gmail and Yahoo also require a DMARC record from anyone who sends in bulk.

My subdomain has no DMARC record. Is it unprotected?

Not necessarily. Receivers fall back to the record of the organisational domain, and its sp= tag (or p= when sp is missing) applies to subdomains. The checker follows the same fallback and tells you where the policy came from.

Where do the reports go?

To the mailto: addresses in rua. They are XML files, one per receiver per day, listing every server that sent mail as your domain and whether it passed. A DMARC report service turns them into something readable; a mailbox you control works too.