What this tool checks
DMARC tells receiving servers what to do with email that fails SPF and DKIM, and where to send reports. This checker reads your DMARC record, shows the policy (none, quarantine, or reject), flags a missing reporting address, and presents it with your SPF and DKIM so you can see whether your email is actually protected. A policy of reject or quarantine is what stops spoofing; p=none only monitors.
How to roll out DMARC without blocking mail
Deploy DMARC in stages so you never blackhole legitimate email. Start at p=none with a rua reporting address and watch the aggregate reports for a few weeks to find every service that sends as your domain, then fix their SPF and DKIM. Move to p=quarantine, optionally using pct= to enforce on a fraction of mail first, and only advance to p=reject once the reports are clean. DMARC also requires alignment: the SPF or DKIM domain has to match the visible From domain, not just pass on its own.
Frequently asked questions
What's the difference between p=none, quarantine, and reject?
p=none takes no action and only collects reports (a monitoring phase). p=quarantine sends failing mail to spam. p=reject blocks it outright. Reject is the strongest and the goal for a protected domain.
Where does DMARC live in DNS?
As a TXT record at _dmarc.yourdomain.com, starting with v=DMARC1. This checker looks there automatically when you enter your domain.
Do I need SPF and DKIM for DMARC to work?
Yes. DMARC builds on SPF and DKIM. It decides what happens when those checks fail and confirms the From address aligns. This tool shows all three together so you can spot gaps.
What are the rua and ruf tags?
rua is the address that receives daily aggregate reports (a summary of who's sending as your domain and whether they pass) and is the one you want. ruf requests forensic per-message reports, which most providers no longer send for privacy reasons. Set rua to a mailbox or a DMARC-reporting service before you raise the policy.