DMARC checker.

Check a domain

What DMARC does

DMARC tells receiving mail servers what to do with messages that claim to come from your domain but fail SPF and DKIM checks, and where to send reports about them. Without it, anyone can send email that looks like it comes from your domain.

Reading the policy

p=none only collects reports: spoofed mail is still delivered. p=quarantine asks receivers to put failing mail in spam, and p=reject asks them to refuse it. Most domains start at p=none, read the reports for a few weeks, then move to quarantine or reject once their legitimate senders pass.

Subdomains

A subdomain without its own record is covered by the parent domain's policy, using the sp= tag when the parent sets one. The checker follows that rule, so mail.example.com shows the policy that actually applies to it.

Common problems

• No DMARC record at all.
• A record without a valid p= tag, which receivers ignore.
• A policy left at p=none for months after the reports are clean.
• No SPF record, or more than one, which weakens DMARC alignment.

Keep it from changing silently

DNS records get edited during migrations, provider changes and clean-ups. Domain Watch re-checks SPF, DMARC and the DKIM selectors it discovers every day and emails you when they change.