DMARC record checker
Check whether a domain is protected against email spoofing. We read the DMARC policy, the percentage and the report addresses, and test SPF, DKIM and MTA-STS in the same report.
What is DMARC?
DMARC tells receiving mail servers what to do with email that uses your domain in the From address but fails SPF and DKIM: nothing (p=none), put it in spam (p=quarantine) or refuse it (p=reject). It also lets you receive reports about who sends mail in your name. It is a TXT record on _dmarc.yourdomain:
v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com
From p=none to p=reject in four steps
1. Publish p=none with a rua address and collect reports for two to four weeks.
2. Use the reports to find every service that sends in your name, and fix SPF and DKIM for each of them.
3. Move to p=quarantine, optionally with pct=25 and then 100.
4. Move to p=reject. Fake mail in your name is now refused before anyone sees it.
Why p=none is not protection
With p=none receivers deliver fake mail as normal. It is a measuring stage, not a defence. Big mailbox providers such as Google and Yahoo also require DMARC from bulk senders.
Questions
- Will p=reject block my own email?
- Only mail that fails both SPF and DKIM alignment. That is why you start with p=none and fix every sender first.
- Where do DMARC reports go?
- To the address in rua=. They are XML files; a DMARC report service turns them into readable overviews.
- Do subdomains need their own record?
- No. The record on the main domain also covers subdomains, unless you set a different sp= policy or publish a record on the subdomain itself.
OZAG Technologies · KVK 42167370 · Laan van Oversteen 20, 2289 CX Rijswijk · +31 6 24496620 · support@ozagsecurity.com