DMARC check

Check the DMARC policy of a domain and create a DMARC record

DMARC tells receivers what to do with mail that fails SPF and DKIM and where to send reports. The check reads the record at _dmarc and explains each tag.

DMARC record generator

Pick a policy and an address for reports. Start with none, read the reports for two weeks, then tighten.

Domain Policy Subdomain policy Share of mail, % Address for aggregate reports Address for failure reports (optional)

Strict alignment DKIMadkim=s SPFaspf=s

Add a TXT record with this name and value

Name: _dmarc.example.com
Value: v=DMARC1; p=none

A DMARC shield in front of a message: SPF, DKIM and domain alignment

How DMARC works

DMARC checks alignment: the domain in the From header must match the domain that passed SPF or DKIM. Mail can pass SPF for a service's domain and still fail DMARC for yours.

Aggregate reports from Google, Microsoft, Yandex and others arrive at the rua address once a day. They list every server that sends mail in your name, including the ones you forgot about.

When you need it

Check the domain before a campaign and before a switch to reject
Find every service that sends mail in your name
Protect the domain from spoofed mail

Questions and answers

01Which DMARC policy should I start with?

Start with p=none and a rua address for two to four weeks. Then move to quarantine with a lower pct and finish with reject once the reports show no legitimate mail failing.

02Do I need DMARC if I already have SPF and DKIM?

Yes. Google and Yahoo require a DMARC record from bulk senders since 2024, and without it receivers do not know what to do with forged mail.

03Where does the DMARC record go?

It is a TXT record on the _dmarc subdomain, for example _dmarc.example.com, and it starts with v=DMARC1.

04What does the sp tag do?

It sets the policy for subdomains. Without it subdomains inherit the main domain policy. sp=reject locks the subdomains you never send mail from.

05How do rua and ruf reports differ?

rua sends daily summaries: how many letters from which IP passed the checks. ruf sends copies of single failed letters, but large mailbox providers rarely send it. rua is enough for the work.