DMARC check: is your domain protected against forged mail?

What the DMARC check covers

The record

Whether there is exactly one DMARC record under _dmarc, or the domain inherits its policy from a parent domain.

Policy

What happens to mail that fails DMARC: delivered (none), sent to spam (quarantine) or rejected (reject), and to what share of mail that applies.

Subdomains

Whether subdomains get a weaker policy than the domain itself.

Alignment

How strictly the SPF and DKIM domains have to match the visible From address.

Report addresses

Whether the rua and ruf addresses are valid, and when they point to another domain, whether that domain has agreed to receive the reports.

Common mistakes

A record published at the wrong name, a missing semicolon or "mailto:", mistyped tags, several records.

Frequently asked questions

What is DMARC?

DMARC is a policy published in DNS that tells receiving servers what to do with mail that uses your domain as sender but passes neither SPF nor DKIM. It also asks them for reports about who sends mail in the name of the domain.

Which policy should I start with?

Start with "p=none" and a rua address: nothing changes in how your mail is delivered, but the reports start arriving. Once they show that all your own mail passes, move to "quarantine" and then "reject".

Why do I get no DMARC reports?

The usual causes: there is no rua tag; the address lacks the "mailto:" prefix; or it points to another domain that has not published the record agreeing to it. The check reports all three. Reports arrive once a day, and only from providers that received mail from the domain.

Is DMARC required?

Since 2024 Gmail and Yahoo require a DMARC record from anyone sending thousands of messages a day, and more providers are following. It is worth having for small domains too: without a record, anyone is free to forge addresses at the domain.