Free tool
DMARC checker
Enter a domain to read its DMARC record: what it protects, what every tag means, and the record to publish next.
Sending outreach from this domain? GEOboom finds the pages AI answers cite and runs the outreach to get you mentioned on them, with the mailboxes included.
See how it worksGetting to p=reject without losing mail
1. Monitor
Publish p=none with a rua address. Receivers start sending daily reports of every server that sends as you, passing or not. Nothing changes for delivery.
2. Fix what fails
Every service in the reports that is yours and failing needs SPF or DKIM set up for your domain. Anything that isn't yours is somebody spoofing you, which is what the next steps stop.
3. Enforce
Move to p=quarantine, watch the reports for a few weeks, then p=reject. At reject, mail that claims to be from you and fails is refused outright.
Questions
What does a DMARC checker check?
It looks up the TXT record at _dmarc.yourdomain.com, or at the parent domain's if a subdomain has none, and reads it: whether there is exactly one valid record, what policy it sets, whether subdomains are covered, and where reports go. It can't see whether your mail actually passes DMARC. That depends on SPF and DKIM for each message, which only the receiver's reports show.
Is p=none bad?
It's the right place to start and the wrong place to stay. With p=none receivers report failing mail but deliver it, so anyone can still send as your domain. Use it for a few weeks to find every service that sends for you, then move to quarantine.
How do I know it's safe to move to quarantine or reject?
When the aggregate reports at your rua address show only your own services, all passing, for two to four weeks. Anything failing that is yours, such as a CRM or helpdesk nobody added to SPF or DKIM, has to be fixed first, or its mail starts going to spam.
Do subdomains need their own DMARC record?
No. A subdomain without one uses the parent domain's record, under its sp= policy, or p= if there is no sp=. Give a subdomain its own record only when it needs a different policy, such as a marketing subdomain still at p=none.
Why does my report address need permission?
If rua points at a different domain, such as a DMARC report service, that domain has to publish a record saying it accepts your reports. Otherwise receivers won't send them. Report services set this up for their customers, so a missing one usually means the service isn't configured for your domain yet.