DMARC checker
See what your domain tells mail servers to do with mail that fails the checks, and get the record to publish.
What this checks
Four things we read off your domain.
The record itself
We read the TXT record on _dmarc plus your domain and show it exactly as a mail server sees it.
What the policy does
p=none, quarantine or reject, said in plain words: what happens to a message that fails the checks.
Whether reports come back
rua is the address your daily summaries go to. With no rua you never find out who is sending as you.
The settings around it
sp for subdomains, pct for how much of your mail the policy covers, adkim and aspf for how closely names have to match.
How to fix it
Publish a record, watch, then tighten it.
DMARC is one TXT record and a few weeks of reading what comes back. These are the steps in the order most setups take them.
- 01
Open the DNS panel for your domain
It is wherever your name servers point: the registrar you bought the domain from, or the host you moved it to. You are looking for the page that lists A, MX and TXT records.
- 02
Add one TXT record on the _dmarc host
Host or name is _dmarc, type is TXT, and the value is the line below with your own address in it. Some panels want the full host instead, which is _dmarc.yourdomain.com.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r
- 03
Read the reports for a few weeks
The summaries come back as a daily file from each mail provider. They show every server sending as you and whether it passed SPF and DKIM. Fix the real senders that fail, and you will often find a newsletter tool or an invoicing app nobody had listed.
- 04
Tighten the policy once the reports are clean
Move to quarantine on a slice of your mail first, then on all of it, then to reject. Each step is an edit to the same record.
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com then v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
Questions
The things people ask next.
What is DMARC?+
DMARC is a line you publish in your domain's DNS. It tells mail servers what to do with a message that claims to come from you and fails the SPF and DKIM checks, and where to send reports about what they saw.
Does DMARC need SPF or DKIM first?+
Yes. DMARC is the policy on top of those two checks. A message passes DMARC when it passes SPF or DKIM and the domain in that check matches the domain people see in the From line.
Is p=none enough?+
p=none asks for reports and changes nothing about how mail is handled, so the domain is still open to anyone sending as you. It is the right first step while you find your own senders. Protection starts at quarantine and is complete at reject.
How long does a change take to work?+
A DNS change is live once the old record's time to live has passed, which is usually minutes to a few hours. Summary reports arrive once a day from each mail provider, so give it a week before you read anything into them.
The same work, every client
Your AI can run this and 800+ more checksfor every client.
The email deliverability audit runs this check and the rest of them on every domain you work with, then writes the fix list your client can hand to their IT person.