DMARC tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM. Enter your domain to see your DMARC policy and what it means in practice.
What the results mean
| Policy | Status | What happens to spoofed email |
|---|---|---|
| No record | ■ Act now | Most inboxes accept it. |
p=none |
■ Act now | Reported, then delivered anyway. |
p=quarantine |
● Fine | Goes to spam. |
p=reject |
● Fine | Refused. |
p=none is the right first step and the wrong place to stay: it watches but
doesn't protect.
Getting to p=reject safely
- Publish
p=nonewith a report address and read the reports for a few weeks. - Turn on DKIM for every service that sends as you.
- Move to
p=quarantine, thenp=reject.
The full path, with the records to publish: DMARC p=none to p=reject.
Same scan, also checked
- SPF, including the 10-DNS-lookup limit that silently breaks it: SPF lookup counter.
- Mail servers (MX) for the domain.
- Lookalike domains that DMARC can't protect against: lookalike domain checker.