DMARC Record Checker

DMARC ties SPF and DKIM to the visible From address

Both SPF and DKIM authenticate something the recipient never sees. DMARC requires that at least one of them passes and aligns with the From domain the user reads. That alignment is what actually blocks the spoofing SPF and DKIM alone permit.

Three policies, in the order you should deploy them

p=none enforces nothing and only collects reports — the correct starting point. p=quarantine sends failures to spam. p=reject blocks them outright. Jumping straight to reject before reading reports reliably blocks legitimate mail from a forgotten system: the invoicing platform, the CRM, the monitoring alerts.

Relaxed and strict alignment

Relaxed, the default, allows a subdomain to align with the organisational domain. Strict requires an exact match. Strict alignment breaks mail sent from subdomains that most organisations do not realise they use.

Reports are the point of p=none

rua receives aggregate XML reports listing every IP sending as your domain. Those reports are how you discover the legitimate senders nobody documented, and they are the reason a monitoring period of several weeks precedes any enforcement. A record with a policy and no rua address discards the only feedback available.

Subdomains inherit unless told otherwise

The sp tag sets a separate policy for subdomains. Without it they inherit the parent, which matters because unused subdomains are a common spoofing target and generally deserve sp=reject even while the parent is still at none.