Analyze your domain's DMARC policy
Check your DMARC record, understand your current policy (none / quarantine / reject), and find out if your domain is protected against spoofing.
What is DMARC?DMARC tells receiving servers what to do with mail that claims to be from your domain but fails authentication. It is a TXT record at _dmarc.yourdomain. Gmail and Yahoo require DMARC for bulk senders, and Outlook.com requires it for senders of 5,000 or more messages a day.
This checker reads the DMARC record, shows the policy (none, quarantine or reject), the subdomain policy, the pct value and where aggregate reports (rua) go.
How to read the result
- p=reject: failing mail is refused. This is full protection against spoofing.
- p=quarantine: failing mail goes to spam. A good step before reject.
- p=none: monitoring only. Nothing is blocked, but you get reports. It meets the Gmail and Yahoo minimum.
- Missing: there is no record at _dmarc. Bulk mail to Gmail can be rate limited or blocked (codes 4.7.40 and 5.7.40).
- pct below 100: the policy applies to only part of the failing mail.
- sp=none with p=reject: subdomains are not protected, so attackers can spoof anything.yourdomain.
Alignment, in one paragraph
DMARC passes when SPF or DKIM passes for the same domain as the visible From address. This is called alignment. A message can pass SPF for your email platform's bounce domain and still fail DMARC, because that domain is not yours. Set up a custom return path or DKIM with your own domain in each sending service.
Example
A DMARC record that collects reports while you check your senders
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
After the reports show all real mail passes, change p=none to p=quarantine, then p=reject. The DMARC generator builds the record for you.
Common problems and fixes
DMARC p=none
Why monitoring-only leaves you open to spoofing, and how to move on.
DMARC alignment failure
SPF or DKIM passes, but for the wrong domain.
DMARC fail with quarantine
Real mail lands in spam because of your own policy.
Gmail 550 5.7.26
Unauthenticated mail blocked by Gmail.
Microsoft 550 5.7.509
The domain fails DMARC and publishes p=reject.
Frequently asked questions
Is p=none enough for Gmail and Yahoo?
Yes. Both require a DMARC record for bulk senders, and p=none meets that rule. It gives no protection against spoofing, so plan to move to quarantine or reject.
Where do DMARC reports go?
To the address in rua=. Gmail, Yahoo and Microsoft send daily XML aggregate reports there. EmailHealth has a free DMARC report inbox and a report parser that turn them into a list of who sends as your domain.
How long should I stay at p=none?
Until the reports show that every real sending service passes SPF or DKIM with alignment. For most domains that takes two to six weeks.
Do I need a DMARC record on each subdomain?
No. The record on the main domain covers subdomains unless you set sp= or publish a separate record on a subdomain.
What is DMARC alignment?
The domain that passed SPF or DKIM must match the From domain. Relaxed alignment (the default) allows subdomains to match the main domain.