Free DMARC check

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the rule that decides what a receiving mail server should do with email claiming to be from your domain but which SPF or DKIM cannot confirm. Without DMARC, every mail server decides that for itself, with varying results.

The record sits as a TXT record on _dmarc.yourdomain.com and looks roughly like this: v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com. The most important value is p=, the policy:

• p=none: measure only, nothing is blocked. Fine as a starting point, not as an end state.
• p=quarantine: suspicious email goes to spam/junk. Partial protection.
• p=reject: suspicious email is refused. Maximum protection against spoofing and phishing in your domain's name.

Many domains stay on p=none for years out of caution. That is understandable, because moving to p=reject too quickly can block legitimate email if not all of your own sending services (CRM, newsletter, accounting package) are set up correctly. That is exactly what the rua= reports are for: they show which sources are mailing on behalf of your domain and whether they pass, so you can move up to a stricter policy on solid ground.

DMARC requires that at least one of SPF or DKIM passes and is "aligned" with the visible sender domain. If you have set up neither yet, start with SPF and DKIM. DMARC is the last step, not the first.