DMARC Checker

What the policy means in practice

DMARC sits on top of SPF and DKIM. It tells receivers what to do when neither aligns with the From domain, and where to send reports about it. This tool reads the record at _dmarc.yourdomain, validates the tags, and shows whether reports are actually going anywhere.

Should I start at p=none, quarantine or reject?

p=none, always. It enforces nothing, but it turns on aggregate reports - and those reports are how you discover the invoicing system, the CRM and the old marketing tool that have been sending as your domain for years. Move to quarantine once those are authenticated, and to reject once quarantine produces no surprises.

What does the pct tag do?

pct applies the policy to a sample of failing mail rather than all of it, so pct=10 with p=quarantine means one in ten failing messages is quarantined. It is a rollout control, not a permanent setting, and it is ignored entirely when the policy is none.

Do I need a separate record for subdomains?

Only if you want different treatment. The sp tag sets the subdomain policy; without it subdomains inherit p. A common pattern is p=none while you audit, with sp=reject straight away, because an unused subdomain has no legitimate mail to break.

I get the reports but cannot read them.

Aggregate reports are gzipped XML, sent daily, and designed for machines. Point rua at an address that feeds a parser rather than a person. The forensic ruf stream is different - far fewer providers send it, and it contains message content, so treat it accordingly.