What this checks
DMARC sits on top of SPF and DKIM and decides what a receiver should do when a message
fails authentication, and whether the visible From: domain can be tied to an authenticated
one (alignment). This checker reads the record at _dmarc.<domain> and reports its
policy, how much of your mail that policy covers, the separate policy for subdomains, and where
aggregate reports are sent.
How to read the results
The policy badge is the whole game. p=none means "watch, but enforce
nothing" — failing mail still lands in the inbox. p=quarantine diverts failures to spam;
p=reject refuses them outright. The pct value is the fraction of mail the
policy is applied to (100 unless you're staging a rollout), and sp sets a distinct policy
for subdomains. rua lists the addresses that receive the aggregate reports — shown here as
plain text, never a clickable link.
Where DMARC goes wrong
- Stuck at
p=noneforever. Monitoring is meant to be temporary. A record that never advances pastnoneenforces nothing and leaves the door open to exact-domain spoofing indefinitely. - No
ruaaddress. Without an aggregate-report destination you're flying blind — you can't see which senders a tighter policy would affect before you commit to it. - Enforcing before sources are clean. Jumping straight to
p=rejectwhile a legitimate sender still fails alignment bounces real mail. Thepctdial and the reports exist so you can raise enforcement gradually. - A missing or malformed record. No
_dmarcrecord leaves receivers to their own heuristics; a single syntax error can make the whole record be ignored.
FAQ
What does p=none actually do?
Nothing to delivery. It's monitoring mode: receivers evaluate authentication, send you reports, and deliver the message regardless of the outcome. It's the right place to start and the wrong place to stay.
When should I move to reject?
Once your aggregate reports show every legitimate source passing alignment and no unexplained passing
sources remain. Many teams step none → quarantine → reject over weeks, using pct
to ramp each stage rather than flipping the whole flow at once.
What is rua?
The rua tag lists addresses that receive aggregate reports — a periodic XML summary from
each receiver of how much mail claimed your domain, how much authenticated, and from which IPs. It's the
feedback loop that makes tightening the policy safe.
Does DMARC require both SPF and DKIM?
No — a message passes DMARC if either SPF or DKIM passes with alignment. Publishing both is still strongly recommended, because DKIM survives message forwarding where SPF frequently breaks.