DMARC Checker
Look up any domain's DMARC record and get an honest grade: is this domain actually protected against spoofing, or just going through the motions?
What DMARC actually does
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that sits on top of SPF and DKIM. Those two answer "was this server allowed to send?" and "is this signature valid?" — but neither tells a receiving server what to do when the answer is no, and neither ties the result to the From address your customers see. DMARC does both. It is published as a single TXT record at _dmarc.yourdomain.com, and it is the difference between "we have email authentication" and "nobody can impersonate us".
The only tag that really matters: p=
p=none is monitoring mode — receivers report what they see and deliver everything anyway. It is the right place to start and a dangerous place to stay: a domain parked at p=none for years is unprotected while believing otherwise. p=quarantine sends failing mail to spam. p=reject refuses it at the door, and is the only end-state that actually stops spoofing.
The safe path up is boring and proven: publish p=none with an rua address, read the aggregate reports for two to four weeks until every legitimate sender passes, then step to quarantine (optionally at a rising pct), then reject. Domains break their own mail by jumping straight to reject with an undiscovered sender still failing — the reports exist precisely to prevent that.
Why DMARC became non-optional
Since February 2024, Google and Yahoo require DMARC for bulk senders, and Microsoft followed in May 2025 for Outlook.com. Send more than ~5,000 messages a day to those inboxes without DMARC and your mail is throttled or refused. But the requirement is not the real reason to finish the job — roughly half of sending domains still have no enforced policy, which means spoofing someone else's brand remains trivially easy, and the brands that get spoofed are the ones attackers find worth impersonating.
Reports are the hidden half of DMARC
The rua tag tells receivers where to send daily aggregate reports — XML files listing every server seen sending as your domain and whether it passed. Without an rua address you get the policy but none of the visibility: you cannot know which forgotten service is about to break when you tighten enforcement, and you cannot see spoofing attempts at all. Raw XML is unreadable at any volume, which is why report parsing is the feature people end up paying for — it is built into UptimeVitals monitoring rather than being a separate per-domain subscription.
DMARC Checker — frequently asked questions
How long does it take to reach p=reject safely?
For a typical small business domain: two to six weeks. One to two weeks of reports at p=none to inventory senders, fix their SPF/DKIM, then a week or two at quarantine before reject. Domains with few senders move faster.
Will DMARC break my email?
p=none cannot break anything — it only generates reports. Breakage happens when enforcement is raised before every legitimate sender is aligned. The reports tell you exactly who would break, before you enforce.
Do subdomains need their own DMARC records?
Not usually — they inherit the organisational domain's policy unless you set an sp tag or publish a subdomain record. Note that a subdomain record overrides the parent entirely.
What is the difference between rua and ruf?
rua gets daily aggregate summaries (volumes, sources, pass rates). ruf gets per-failure forensic reports, which many large receivers no longer send for privacy reasons. rua is the essential one.
No DMARC record at all — where do I start?
Generate a monitoring record with our DMARC Generator, publish it, and let reports accumulate before enforcing anything.