Search tools

DMARC checker

What a domain's DMARC record tells receivers to do with forged mail, tag by tag, and what to change. Then build the next step towards p=reject.

Every tag explained Report addresses checked Record builder

Build a DMARC record

Start at none, read the reports, then tighten

TXT record at _dmarc.example.com

Steps to p=reject

    Next

    Sent from your browser, not through webdaveAsked: nothing yet

    What is DMARC?

    Short answer

    DMARC is a TXT record at _dmarc. plus the domain that tells receivers what to do with mail whose From address claims the domain but fails both SPF and DKIM for it: deliver it (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It also asks receivers to send reports of who sends as the domain.

    DMARC tags

    v=DMARC1Required, and must come first
    p=The policy: none, quarantine or reject
    sp=The policy for subdomains, when it differs
    pct=The share of failing mail the policy applies to (100 when left out)
    rua=Where daily summary reports go (mailto: addresses)
    ruf=Where copies of single failures go; few receivers send them
    adkim=, aspf=Alignment: r (relaxed, subdomains count) or s (strict, exact match)
    fo=When failure reports are sent: 0, 1, d or s

    How to move from p=none to p=reject

    1. Publish v=DMARC1; p=none; rua=mailto:… and collect reports for two to four weeks.
    2. Find every service that sends as the domain (newsletters, invoicing, the CRM, the copier) and make it pass SPF or DKIM with your domain.
    3. Move to p=quarantine, optionally with pct=25 and then higher.
    4. When reports show only forgeries failing, move to p=reject.

    Questions

    For their bulk sender rules, yes: they ask for a DMARC record of at least p=none. It does not stop forgeries, though, so treat it as the first step.

    The record needs a rua= address. When it is on another domain (a report service), that domain must publish yourdomain._report._dmarc.theirdomain; the checker looks for it.

    No: a subdomain without one uses the main domain's record, with its sp= policy (or p= when there is no sp=). Give one its own record only when it needs a different policy.