DMARC record checker and policy generator
Read a domain's DMARC policy, see which rung of the ladder it is on, and get the record to publish next.
DMARC tells receivers what to do when a message claiming to be from your domain fails both SPF and DKIM alignment — and gives you a reporting channel showing who is sending as you. p=none changes nothing about delivery and is monitoring only; p=quarantine sends unaligned mail to spam; p=reject refuses it. Gmail and Yahoo require at least p=none from anyone sending roughly 5,000 messages a day.
| Week | Record | What changes |
|---|---|---|
| 0 | p=none; rua=…; fo=1 | Nothing. Reports start arriving. |
| 2 | Review the reports | Fix every legitimate source failing alignment. |
| 3 | p=quarantine; pct=25 | A quarter of unaligned mail goes to spam. |
| 4 | p=quarantine; pct=100 | All unaligned mail goes to spam. |
| 6 | p=reject | Unaligned mail is refused outright. |
What does p=none actually do?
Nothing, to delivery. It is a monitoring policy: receivers evaluate alignment, report the result to your rua address, and then deliver the message as they would have anyway. That is exactly why it is the right first rung — you get two weeks of data showing which of your own systems fail alignment before you start affecting real mail.
How do I move from p=none to p=reject safely?
Four steps over about six weeks. Week 0: publish p=none with a rua address and collect reports. Week 2: review the reports and fix every legitimate source that is failing alignment. Week 3: move to p=quarantine with pct=25, then 50, then 100, watching the reports at each step. Week 6: p=reject. Jumping straight to reject is how a company discovers, from its customers, that its invoicing system was never SPF-aligned.
What is DMARC alignment and why does it need a custom MAIL FROM?
Alignment requires that the domain in the visible From header matches the domain validated by SPF (which checks the invisible Return-Path) or by DKIM (which checks the d= tag). If your sending platform uses its own bounce domain as the Return-Path, SPF passes but does not align with your From domain — so you are relying on DKIM alone, and any forwarding that breaks DKIM breaks DMARC. A custom MAIL FROM subdomain on your own domain fixes this permanently, with two DNS records.
Why point rua at a service instead of my own inbox?
Aggregate reports are XML, arrive daily from every major receiver, and are unreadable by hand at any volume. A service parses them into “which sources are sending as you, and which of them are failing alignment” — which is the only question you actually want answered.