What the DMARC check looks at
- Whether a DMARC record exists at _dmarc and is valid
- The policy: none, quarantine or reject, and the subdomain policy
- Whether reports are being sent anywhere (rua)
- Whether SPF and DKIM are in place for DMARC to work
What the results mean
Every tool runs the same free check, which reads your MX, SPF, DKIM, DMARC, MTA-STS, website certificate, HTTPS, registration, DNSSEC and lookalike domains in one go.
- No record: anyone can send email as this domain and receivers have no instruction to stop it
- p=none: reports only. A good first stage, but it doesn't block spoofing
- p=quarantine: failing mail goes to spam
- p=reject: failing mail is refused. The goal
Questions
- What is a DMARC record?
- A DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF and DKIM checks, and where to send reports.
- What should my DMARC record be?
- Start with v=DMARC1; p=none; rua=mailto:your-reports-address, then move to quarantine and reject once your legitimate senders pass.
See where your company stands
Check a domain for free, then connect Microsoft 365 or Google Workspace for the full checkup. Every new workspace gets a 7-day trial, no card needed.