Check your DMARC record, see if it actually stops spoofing, and get the exact record to publish next. SPF and DKIM are checked too, because DMARC depends on them.
Checking SPF, DKIM, DMARC and MX records…
Live DNS lookups via Cloudflare DNS-over-HTTPS. Nothing is stored.
WEEKS 1–4
Publish with a rua address. Read reports and list every service sending as your domain. Fix SPF/DKIM for each one.
v=DMARC1; p=none; rua=mailto:dmarc@example.com WEEKS 5–8
When reports show your own mail passing, quarantine failing mail. Optionally start at pct=25 and raise it.
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com WEEK 9+
No legitimate failures for a few weeks? Reject. Spoofed mail is now blocked before it reaches anyone.
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Domains that never send email can skip straight to v=DMARC1; p=reject; together with an SPF of v=spf1 -all.
| Tag | Meaning | Default |
|---|---|---|
| v=DMARC1 | Required, must be first | — |
| p= | Policy: none, quarantine or reject | Required |
| rua=mailto:… | Address for daily aggregate reports | Strongly recommended |
| sp= | Policy for subdomains | Same as p |
| pct= | Percent of failing mail the policy applies to | 100 |
| adkim= / aspf= | Alignment: r (relaxed) or s (strict) | r |
| ruf=mailto:… | Per-message failure reports (rarely sent) | Optional |
| fo= | When to generate failure reports | 0 |
Publish it as a TXT record with the host _dmarc (full name _dmarc.example.com).
If your reports go to a different domain, that domain must publish an authorization record, which most report services do for you.
Yes, it's strongly recommended. Since 2024 Gmail and Yahoo require DMARC for senders of 5,000+ messages a day, and Microsoft (Outlook.com) followed in 2025 — but every domain benefits. Without DMARC, anyone can send mail that appears to come from your domain, and your legitimate mail has a weaker reputation signal.
p=none meets the minimum Gmail/Yahoo requirement, but it doesn't stop spoofing: mail that fails DMARC is still delivered. It's meant to be temporary — a few weeks of collecting reports so you can find all your legitimate senders before moving to p=quarantine and then p=reject.
Only mail that fails both SPF and DKIM alignment. That's why you move gradually: read your reports on p=none, fix every legitimate service (newsletter tool, CRM, helpdesk, billing system) so it passes, then quarantine, then reject. The usual surprises are invoicing tools and old servers sending as your domain.
DMARC passes only if SPF or DKIM passes for a domain that matches the visible From address. With relaxed alignment (the default) a subdomain counts — mail.example.com aligns with example.com. A marketing tool that passes SPF with its own domain but signs nothing with yours will still fail DMARC; set up DKIM for that tool with your domain.
Aggregate reports (rua) arrive daily as zipped XML files from Google, Microsoft, Yahoo and others. Each lists the IPs that sent mail as your domain and whether SPF and DKIM passed. Raw XML is hard to read, so most people send them to a free or paid DMARC report service, or a dedicated mailbox they review weekly.
No. If mail.example.com has no record, receivers use example.com's record, applying its sp= policy (or p= if sp is not set). Give a subdomain its own record only when it needs a different policy.
Free tools for network engineers — no signup, no rate-limit walls.