What does a DMARC record do?

It tells receiving servers what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it. The record lives at _dmarc under the domain and its p= tag carries the instruction: none, quarantine or reject. Without one, receivers decide for themselves and no reports are sent.

What is DMARC alignment?

Alignment is the requirement that the domain which passed SPF or DKIM matches the domain in the From header. Relaxed alignment, the default, accepts a match on the organisational domain; strict alignment demands an exact match. Without alignment a message could pass SPF for one domain while displaying an entirely different one to the reader.

Should I start at p=none or p=reject?

Start at p=none with a rua address, and read the aggregate reports until every legitimate sending source appears aligned. Then move to quarantine and finally to reject. Publishing p=reject before you know which systems send as your domain is how internal notifications and invoices start being refused rather than delivered.

What is the difference between rua and ruf?

rua names the addresses for aggregate reports: daily XML summaries of volume and authentication results per sending source, with no message content. ruf names addresses for forensic reports, which are per-message samples. Most large receivers send aggregate reports and very few send forensic ones, so rua is the tag worth publishing.

Do subdomains inherit the DMARC policy?

Yes. A receiver that finds no record at the subdomain falls back to the organisational domain and applies that one. When it does, the sp= tag governs rather than p=, so a parent with p=reject and sp=none leaves every subdomain unprotected. Publish sp= deliberately rather than letting it default.

DMARC record checker: test your DMARC policy

What a DMARC record looks like

A DMARC record is a TXT record at _dmarc under the domain, beginning with v=DMARC1 and carrying a p= tag that states what a receiver should do with mail that fails. Everything else is optional: a subdomain policy, alignment modes, a sampling percentage and the addresses reports are sent to.

Unknown tags are ignored rather than treated as an error, but the order of the first two is fixed: v= comes first, and p= is expected immediately after it. A record with no usable p= is discarded, and the domain is treated as publishing nothing.

A DMARC record at its strictest: reject for the domain and its subdomains, strict alignment on both checks, and an address for aggregate reports.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]"

DMARC alignment is the part that surprises people

A DMARC pass needs more than an SPF or DKIM pass. It needs the domain that passed to line up with the domain in the From header a reader sees. SPF authenticates the envelope sender and DKIM authenticates the d= tag of the signature, and either can pass for a domain the recipient never sees.

Relaxed alignment, the default, accepts a match on the organisational domain, so a signature from a subdomain aligns with a From address at the parent. Strict alignment, adkim=s and aspf=s, demands an exact match. Strict is stronger and it is also what breaks first when a sending platform signs with its own subdomain.

One aligned pass is enough. A message that fails SPF but carries an aligned DKIM signature passes DMARC, which is why DKIM is the one that survives forwarding.

p=none, p=quarantine and p=reject

p=none asks for nothing. Mail that fails is delivered exactly as before, and the only thing the record does is cause reports to be sent. It is the right place to start and the wrong place to stay.

p=quarantine asks receivers to file failing mail as spam. p=reject asks them to refuse it at the SMTP conversation, so a forged message is bounced back to whoever sent it rather than landing in a junk folder. Only p=reject actually stops the abuse the record exists to stop.

The pct tag applies a policy to a sample of failing mail, which is a way of moving from none to quarantine gradually. Note that it does not sample the reports — you see everything either way.

Subdomains and the organisational domain

A receiver looking for a policy first queries _dmarc under the exact domain in the From header. If nothing is published there it falls back to the organisational domain, the registrable name found through the public suffix list, and applies that record instead.

When the policy is inherited that way, the sp= tag decides the outcome rather than p=. A parent publishing p=reject with no sp= covers its subdomains at reject; a parent publishing sp=none leaves every subdomain unprotected while looking strict at the apex.

rua= and why you publish it before tightening

The rua tag names the addresses that receive aggregate reports: one XML document per receiver per day, listing every source that sent mail claiming to be you, with volumes and SPF, DKIM and DMARC results. It is the only view you get of the sending you have forgotten about — the invoicing system, the ticketing tool, the marketing platform somebody set up in 2019.

Publish rua=, read a few weeks of reports, fix the sources that matter, and only then move the policy. Moving to p=reject without that step is how a company discovers its payroll notifications were never aligned.

SenderProbe ingests these reports for you: point the rua= tag at the address your workspace is given, or upload reports you already have.

What the DMARC record checker reports

The record as published, and whether it was found at the domain or inherited from the organisational domain.
The effective policy a receiver applies to the name you asked about.
Alignment mode for SPF and for DKIM, and the pct value in force.
The rua and ruf addresses, and whether they are usable.
Syntax that makes a record invalid, such as a missing v= or a p= that is not first after it.

Run this check on your own domain. A workspace takes a minute to create and runs every one of the eleven checks against the domain you name.

Check my domain

Common questions

What does a DMARC record do?: It tells receiving servers what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it. The record lives at _dmarc under the domain and its p= tag carries the instruction: none, quarantine or reject. Without one, receivers decide for themselves and no reports are sent.
What is DMARC alignment?: Alignment is the requirement that the domain which passed SPF or DKIM matches the domain in the From header. Relaxed alignment, the default, accepts a match on the organisational domain; strict alignment demands an exact match. Without alignment a message could pass SPF for one domain while displaying an entirely different one to the reader.
Should I start at p=none or p=reject?: Start at p=none with a rua address, and read the aggregate reports until every legitimate sending source appears aligned. Then move to quarantine and finally to reject. Publishing p=reject before you know which systems send as your domain is how internal notifications and invoices start being refused rather than delivered.
What is the difference between rua and ruf?: rua names the addresses for aggregate reports: daily XML summaries of volume and authentication results per sending source, with no message content. ruf names addresses for forensic reports, which are per-message samples. Most large receivers send aggregate reports and very few send forensic ones, so rua is the tag worth publishing.
Do subdomains inherit the DMARC policy?: Yes. A receiver that finds no record at the subdomain falls back to the organisational domain and applies that one. When it does, the sp= tag governs rather than p=, so a parent with p=reject and sp=none leaves every subdomain unprotected. Publish sp= deliberately rather than letting it default.

Keep reading

Related checks, definitions and guides.

Check the DMARC policy published at _dmarc