Free Email Tool
Analyze your DMARC policy, enforcement level, reporting configuration, and alignment settings.
Retrieve and analyze your DMARC policy. Checks enforcement level, reporting addresses, and alignment settings.
p=none — Monitor only, no filtering. Start here.
p=quarantine — Failing mail goes to spam. Use after 30+ days of clean reports.
p=reject — Failing mail rejected. Maximum protection. Use DMARC Generator to build your record.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that binds SPF and DKIM together and makes email authentication enforceable. Without DMARC, passing SPF and DKIM don't prevent spoofing from the visible From address — anyone can forge your domain in the header recipients actually see. DMARC closes this gap by requiring alignment between the authenticated domain and the visible From address, and by specifying what to do with mail that fails those checks.
DMARC operates through alignment. For a message to pass DMARC, either the SPF-authenticated domain must align with the From domain, or the DKIM-signing domain must align with the From domain. Relaxed alignment (the default) allows subdomains to align — so if your From domain is yourdomain.com and the DKIM signature is from mail.yourdomain.com, alignment passes. Strict alignment requires an exact match between the authenticated domain and the From domain.
When DMARC alignment fails (neither SPF nor DKIM align with the From domain), the DMARC policy determines what happens: none delivers the mail normally but generates reports, quarantine routes it to the spam folder, and reject rejects it entirely. The policy is per-percentage with the pct= tag — you can apply quarantine to 10% of failing mail initially and increase gradually.
Rushing to p=reject without monitoring first is one of the most common DMARC mistakes. The correct sequence:
Since February 2024, Google and Yahoo require DMARC (at minimum p=none with a valid rua= address) for all bulk senders sending more than 5,000 messages per day to Gmail or Yahoo addresses. Senders without DMARC face deferral, and senders without DKIM may face permanent blocking. Microsoft has issued similar requirements for Outlook.com.
The Google/Yahoo requirements are specifically: (1) authenticate with SPF or DKIM, (2) have a DMARC record (any policy), (3) keep spam complaint rates below 0.1%, (4) enable unsubscription in one click. This checker helps verify #2 instantly.
The rua= tag in your DMARC record specifies where aggregate reports are sent. Gmail, Outlook, Yahoo, and other large receivers send these XML reports daily. Each report contains: the receiving domain, the date range, the sending IP, SPF and DKIM authentication results, the disposition applied, and the count of messages. Processing these reports reveals who is sending under your domain — both authorized and unauthorized sources.
DMARC p=reject prevents delivery of spoofed mail at DMARC-aware receivers. But not all receivers check DMARC. Older mail servers, some corporate mail systems, and mailing list software may not implement DMARC. Also, look-alike domains (typosquats like y0urdomain.com) are not covered by DMARC — you'd need to register and protect those separately.
The sp= tag lets you apply a different policy to subdomains than to the root domain. If you set p=reject but sp=none, mail from subdomains that fails alignment would only be monitored, not rejected. Useful during migration when some subdomains aren't fully configured yet. If sp= is omitted, subdomains inherit the p= policy.
