DMARC is the record that ties SPF and DKIM to the address people actually see in the From line, and tells receiving servers what to do when neither passes for your domain. Without it, anyone can send mail that looks like it came from you. Gmail and Yahoo require one from anyone sending in bulk.

What this DMARC checker shows

Enter a domain and the checker reads the record at _dmarc.yourdomain, then:

  • Confirms there is exactly one valid record. With two, receivers ignore DMARC entirely. Without a valid p=, they ignore the record.
  • Explains every tag: the policy for your domain (p=), its subdomains (sp=) and subdomains that don’t exist (np=), the alignment mode, the percentage or testing flag, and where reports go.
  • Checks your reporting addresses. An address on another domain only receives reports if that domain authorises it, and the checker looks that record up for you.
  • Falls back for subdomains. Check send.yourbrand.com and it shows the record that actually applies, which is usually the parent domain’s.

Moving from p=none to reject

Most domains start at p=none with a rua= address, which reports every source sending as the domain without affecting delivery. The reports show which services pass and which don’t. Fix the ones that fail, usually by turning on domain authentication in each service, then tighten the policy:

  1. p=none with reports, until every service you use passes.
  2. p=quarantine, optionally with t=y at first, while you keep watching the reports.
  3. p=reject once they stay clean.

The DMARC report analyzer reads the XML reports and lists what to fix, and the DMARC record generator writes the record for each step.

DMARC needs SPF or DKIM to pass

DMARC passes when SPF or DKIM passes for a domain that matches your From address. Check the other two with the SPF checker and the DKIM checker, or run all three at once with the email deliverability test.