DMARC record checker

p=none is monitoring only. Failing mail is delivered normally and you receive reports about it. This is the correct starting point and the wrong finishing point — a domain on p=none can be spoofed by anyone.

p=quarantine tells receivers to treat failing mail as suspicious, in practice sending it to spam. p=reject tells them to refuse it outright. Reject is the goal, and the path there is to publish none, read the reports until every legitimate sender passes, then move up.

DMARC adds a requirement neither SPF nor DKIM has on its own: the domain that passed authentication must match the domain in the visible From header. This is called alignment, and it closes the exact gap that let a spammer pass SPF for their own domain while displaying yours.

Alignment can be relaxed, the default, where a subdomain matches the parent, or strict via aspf=s and adkim=s, where it must match exactly. Relaxed is right for most senders, because email service providers frequently sign with a subdomain.

rua= names where aggregate reports go — daily XML summaries of what passed and failed, per sending source. These are how you discover the vendor nobody told you about that has been sending as your domain for a year.

ruf= requests forensic reports on individual failures. Most large receivers no longer send them for privacy reasons, so do not rely on it. Aggregate reports are the useful half, and they are unreadable by hand — point them at a parsing service.

Since February 2024, Google and Yahoo require a DMARC record on any domain sending bulk mail to their users. Publishing p=none satisfies the requirement, which is why a great many domains published exactly that and stopped.

That is a real improvement on nothing, because it turns the reports on. But the enforcement benefit only arrives at quarantine or reject, and a domain left at p=none indefinitely has the paperwork without the protection.