What DMARC policy should I use?

Start by monitoring with p=none, then move to quarantine and reject after reviewing reports. p=none collects reports without acting on failing mail. p=quarantine sends it to spam. p=reject refuses it. Move up only when your legitimate senders all pass aligned SPF or DKIM.

Does DNS prove alignment?

No. DNS records describe policy only. Receivers evaluate alignment from the identifiers in a real email.

What do rua and ruf do?

rua names where receivers send aggregate reports, daily summaries of who sent mail as your domain and whether it passed SPF and DKIM. ruf asks for failure reports about individual messages. Many receivers do not send them, so rely on rua. This checker looks for rua and does not test the mailbox.

What is sp= in a DMARC record?

sp sets the policy for subdomains. Without it, subdomains follow p. A subdomain with no DMARC record of its own inherits the policy from the organizational domain, and that record's sp tag applies if it has one.

What does pct do in DMARC?

pct is the percentage of failing mail the policy applies to. The rest gets the next lower treatment: quarantine for p=reject, and none for p=quarantine. It defaults to 100. This checker warns when pct is below 100, because part of your failing mail is not enforced.

Can a domain have more than one DMARC record?

No. Only one v=DMARC1 record is allowed at _dmarc. With two or more, receivers skip DMARC evaluation for the domain. Delete the extras so exactly one remains.

What does an inherited DMARC policy mean?

The domain you entered has no record at _dmarc, so receivers apply the policy of its organizational domain, such as example.com for mail.example.com. The result names the domain the policy came from.

Free email tool

DMARC policy checker.

DMARC tells receivers what to do with mail that fails authentication: p=none to monitor, p=quarantine to send it to spam, p=reject to refuse it. Look up a domain's direct or inherited policy.

What this check can tell you

The result shows the record published at _dmarc on the domain you enter. When there is none, it shows the policy inherited from the organizational domain. It marks the policy as direct, inherited, missing, or invalid, then grades the policy, the reporting address, pct, and the alignment and subdomain tags when present.

Limit: DNS inspection cannot prove SPF or DKIM alignment for a real email. It only reports the public policy receivers can apply.

How to read the DMARC result

The first line says where the policy comes from. The findings under it grade the tags.

Direct policy: A valid v=DMARC1 record at _dmarc on the domain you entered. Receivers apply this one.
Inherited policy: No record at that name, so receivers use the organizational domain's. The result names that domain and shows its record. Read its sp= tag, which sets the policy for subdomains.
No DMARC policy: Warning. Nothing direct and nothing inherited, so receivers have no instruction for mail that fails authentication.
Invalid or duplicate record: Fail. A TXT record at _dmarc that does not start with v=DMARC1, or more than one record. Receivers ignore it.
The p= policy: reject and quarantine pass. none warns because it only monitors. A missing or invalid p= fails.
Reporting and pct: A missing rua address warns, because you get no visibility into who sends as your domain. A pct below 100 warns that only part of failing mail is enforced.

From p=none to p=reject

Publish p=none with an rua address first. Receivers send aggregate reports that list every source sending as your domain, with its SPF and DKIM results. Work through each legitimate source until its mail passes aligned SPF or DKIM, then move to p=quarantine. Raise it to p=reject when the reports stay clean.

A message passes DMARC when SPF or DKIM passes and the passing domain aligns with the From domain. Inspect each side with the SPF checker and the DKIM checker. To see all three records for a domain at once, use the email authentication checker.

An annotated DMARC record

An enforcing policy with reporting and relaxed alignment.

Example DMARC record

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"

v=DMARC1: The version tag. It must come first, or receivers ignore the record.
p=quarantine: What receivers do with mail that fails DMARC: send it to spam.
pct=100: Apply the policy to all failing mail. 100 is the default.
rua=mailto:...: Where aggregate reports go.
adkim=r; aspf=r: Relaxed alignment, the default: the authenticated domain only needs to share the From domain's organizational domain. s requires an exact match.

Common DMARC problems and fixes

Stuck at p=none: Monitoring does not block spoofing. Read your reports, fix the senders that fail, and step up to quarantine and then reject.
Record at the wrong name: The record must sit at the _dmarc label. Some DNS panels append the domain, so entering the full name creates _dmarc.example.com.example.com. Enter only _dmarc.
Two DMARC records: Delete the extra. Keep one record with the policy you want.
v=DMARC1 is not first: A tag or stray text before v=DMARC1 makes the record invalid. Make it the first thing in the value.
No reports arrive: Check the mailto: spelling. If the address is on another domain, that domain must publish a record that authorizes your reports, or receivers withhold them.
SPF and DKIM pass but DMARC fails: The passing domain does not align with your From domain. A third-party sender often uses its own return-path and signing domain. Turn on signing and return-path with your own domain.