DMARC checker

What DMARC actually does

DMARC tells receiving mail servers what to do with a message that claims to be from your domain but fails authentication. Without it, that decision is left to each receiver’s spam filter — which is why spoofed invoices from a lookalike of your own domain land in your customers’ inboxes.

Why p=none is not protection

Most domains that have DMARC have it set to p=none, which asks receivers to take no action at all. It is the right first step because it turns on reporting without breaking legitimate mail, but a domain sitting at p=none for two years is a domain that started a project and never finished it. Protection begins at p=quarantine.

The order to do this in

Publish p=none with a rua= reporting address. Read the reports for two to four weeks and fix every legitimate sender that fails. Move to p=quarantine. Watch for a month. Move to p=reject. Skipping to reject without reading reports is how a company discovers that its invoicing system was never authenticated.

Common questions

What does a good DMARC record look like?

For a domain in the finished state: v=DMARC1; p=reject; rua=mailto:[email protected]. Add pct= only while you are ramping up, and remove it once you are enforcing on everything.

Do I need DMARC if I do not send bulk email?

Yes. DMARC protects against people sending mail as you, which has nothing to do with how much mail you send. A domain that sends no mail at all should publish v=DMARC1; p=reject; precisely because nothing legitimate can break.

Is DMARC required now?

For bulk senders, effectively yes. Google and Yahoo began requiring it for high-volume senders in February 2024 and Microsoft followed for its consumer domains in May 2025. Below those thresholds it is not mandatory, but a missing DMARC record is now a routine finding on cyber-insurance questionnaires.