DMARC Checker

DMARC is a TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with a message that claims to be from you but fails both SPF and DKIM for that domain, and asks them to send you reports about it. This checker reads the record, explains each tag, checks where reports go, and gives you the next record to publish. SPF and DKIM are checked too; the combined view is on the Email Security Checker.

The tags that matter

• p= is the policy for your domain: none (monitor only), quarantine (spam folder) or reject (refuse).
• sp= is the policy for subdomains. If missing, subdomains get the same as p=.
• pct= applies the policy to only part of the failing mail, for gradual rollouts. Missing means 100.
• rua= is where daily aggregate reports go. Without it you are flying blind.
• ruf= asks for per-message failure reports. Few big providers send them now.
• adkim= and aspf= set alignment: r (relaxed, the default) lets mail.example.com count as example.com; s (strict) needs an exact match.

A minimal, valid record looks like v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com;. The v=DMARC1 part must come first and be written exactly like that.

What "alignment" means in practice

DMARC passes when SPF or DKIM passes and the domain they checked matches the domain in the visible From address. This is where most real problems are. A newsletter tool may pass SPF for its own bounce domain, which does not align with yours, so the message fails DMARC anyway. The fix is almost always to turn on DKIM signing with your domain in that tool. DNS alone cannot show alignment; your DMARC reports can.

A safe path from none to reject

1. Monitor. p=none with a report address. Wait two to four weeks and read the reports.
2. Fix senders. For every service you recognise that fails, set up DKIM (or SPF) for your domain in that service. Ignore sources you do not recognise; those are the spoofers DMARC is meant to stop.
3. Quarantine. p=quarantine; pct=25, then 50, then 100 over a couple of weeks, watching the reports.
4. Reject. p=reject. Keep the reports coming so you notice when a new tool is added without DKIM.

The checker marks which step you are on and gives you the exact record for the next one, keeping your existing report address.

Domains that never send email

Parked domains and old brand domains are easy targets for spoofing because nobody watches them. If a domain sends no mail at all, you can skip the rollout and publish v=spf1 -all and v=DMARC1; p=reject; straight away. The checker spots domains with no mail servers and suggests exactly that, with a warning to check that the website's contact form does not send from it.

When DMARC is fine but mail still lands in spam

DMARC proves the mail is yours. It does not make it wanted. Spam complaints, a sudden burst of volume, and a sending server on a blocklist all hurt. A hacked website that sends spam through your own server hurts the most, because that spam passes DMARC under your name. If the trouble started without any DNS change, run the free Laskyr scan on your site.