DMARC record checker

SPF and DKIM each verify something, but neither ties its check to the From address people actually see — that's the gap spoofers use. DMARC closes it: it tells receivers to check that a passing SPF or DKIM identifier aligns with the visible From domain, what to do when neither does (nothing, quarantine, or reject), and where to send reports about it.

p=none is monitor mode: failing mail is delivered normally and you just receive reports. p=quarantine asks receivers to put failing mail in spam. p=reject tells them to refuse it outright — the strongest protection against spoofing, and where every domain should eventually land.

Receivers like Google and Microsoft email a daily XML file to the rua address, summarizing every source that sent mail claiming your domain — IPs, volumes, and SPF/DKIM/alignment results. They contain no message content. They're zipped XML and awkward to read by hand; our DMARC report viewer turns them into a readable table.

Since February 2024, Gmail and Yahoo require senders of 5,000+ messages a day to publish a DMARC record (p=none is enough to comply), pass DMARC alignment, and offer one-click unsubscribe for marketing mail. Smaller senders still need SPF or DKIM. Without these, mail is increasingly rejected or spam-foldered.

Until a few weeks of aggregate reports show every legitimate sending service — your mail provider, newsletter tool, CRM, invoicing app — passing with alignment. Then move to p=quarantine (optionally with pct=25 to ease in), watch the reports again, and finish at p=reject. Rushing to reject before fixing all senders is how legitimate mail gets dropped.