DMARC checker

What DMARC is

DMARC is a single DNS record at _dmarc.yourdomain.com that tells a receiving mail server two things: what to do with a message that claims to be from your domain but cannot prove it, and where to send a report about it.

It only works on top of SPF and DKIM. Those two decide whether a message is authentic; DMARC decides what happens to it when the answer is no. A domain with a perfect DMARC record and no SPF is publishing an instruction nobody can act on.

Reading the record

A record looks like this:

v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100

Each tag does one thing:

• p= is the policy, and it is the tag that matters. none means take no action, quarantine means put it in spam, reject means refuse it at the door.
• rua= is where aggregate reports go. Without it you have published a policy and blinded yourself to its effect.
• sp= sets a different policy for subdomains. If it is absent, subdomains inherit p=.
• pct= applies the policy to a percentage of mail. It exists for rolling a policy out gradually and is a common place to leave a rollout half-finished.

What p=none really means

p=none is the single most common DMARC finding, and it is worth being precise about. It is not broken. It is a monitoring mode: reports still arrive, so you can see who is sending as you before you decide to enforce.

It is a problem when it is permanent. A domain that has published p=none for two years is a domain where somebody set DMARC up, meant to come back to it, and never did — and anybody can still send mail as that domain and have it delivered. The record looks present and correct on every checker, which is exactly why it survives so long.

Why this breaks after you fix it

A DMARC record is one line of DNS, and the things that change it are ordinary: migrating to a new mail provider whose setup guide overwrites the record, tightening a policy and then rolling it back during an incident, or a new subdomain that inherits a policy nobody meant to apply to it.

None of that produces an error anywhere. Mail simply starts being rejected, or silently stops being protected, and the first sign is usually a customer saying they never received something.

What this checker reads

It queries the _dmarc TXT record for the domain, reports the policy verbatim, and lists what is missing or misconfigured. It reads public DNS only — nothing is sent, no account is needed, and the domain you type is not stored.