DMARC record checker
Enter a domain to find its DMARC record and the policy a receiver actually applies to it. When a subdomain publishes nothing, the check follows the parent domain the way receivers do.
What this checks
- The record at
_dmarcon the domain, or on its parent when there is none. - That there is exactly one record and that it starts with
v=DMARC1. - The policy that applies:
p, orspfor a subdomain that inherits. pctbelow 100, which applies the policy to only part of failing mail.- A
ruaaddress, without which no aggregate reports arrive.
Moving to enforcement
A policy of none collects data and blocks nothing. The path from there to
reject, and what to look for in the reports at each step, is in
reading DMARC aggregate reports.
Questions
Which DMARC policy should I use?
Start at p=none with a rua address so aggregate reports arrive, move to quarantine once the reports show all of your own mail passing, then to reject. p=none without a rua address does nothing at all.
Why does my subdomain show a policy it does not publish?
A receiver that finds no record at _dmarc on the subdomain uses the record of the organizational domain, applying its sp= tag if there is one and its p= tag otherwise.
Does DMARC need both SPF and DKIM?
No. DMARC passes when either SPF or DKIM passes and aligns with the domain in the visible From address. DKIM is the one that survives forwarding, so set up both.
DMARC depends on SPF and DKIM. The domain health check tests all three, plus BIMI, MX and reverse DNS.