DMARC Checker

DMARC is a TXT record at _dmarc.yourdomain that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. It builds on SPF and DKIM.

p=none only monitors and takes no action; p=quarantine sends failing mail to spam; p=reject blocks it outright. Reject is the strongest protection against spoofing.

rua is the address that receives daily aggregate XML reports showing who is sending mail as your domain and whether it passed. It is essential for tuning your setup.

Yes. DMARC checks that SPF or DKIM pass AND align with the From domain. Set up SPF and DKIM first, monitor with p=none, then move to quarantine or reject.

Alignment means the domain that passed SPF or DKIM matches the domain in the visible From address. DMARC only passes when at least one of them aligns, which is what actually stops spoofing of your From domain.

Relaxed alignment (the default) allows the organizational domain to match, so a subdomain can align with the parent. Strict alignment requires an exact domain match. The aspf and adkim tags control this.

The pct tag applies your policy to only a percentage of failing mail, letting you roll out enforcement gradually. For example pct=25 with p=quarantine quarantines a quarter of failing messages while you monitor the effect.

Check that the rua address is valid and, if it is on another domain, that the external domain publishes the required authorization record. Some senders also simply do not send reports, so volume varies.

The sp tag sets a separate policy for subdomains, overriding the main p tag for them. This lets you enforce reject on the parent domain while applying a different rule to subdomains.