DMARC record checker

What this checker looks at

• Presence and duplicates. The record lives at _dmarc.yourdomain.com and must be the only one there. Two records, or a record that does not start with v=DMARC1, is ignored entirely.
• The policy. p=none delivers failing mail and only reports it, p=quarantine sends it to spam, p=reject refuses it. The checker says which you have and what the next step is.
• Reporting. Without rua you get no aggregate reports. If reports go to another domain, that domain must publish an authorisation record, and the checker looks for it.
• pct, sp, adkim and aspf. A pct under 100 applies the policy to only part of the mail, sp=none leaves subdomains open, and the alignment tags decide how strictly the From domain must match.
• Typos. Unknown tags are listed, because a misspelled tag name silently disables the setting.

How to read the result

Green means a valid record with an enforcing policy. Amber means the record works but offers little protection yet, most often p=none or a missing reporting address. Red means receivers are ignoring the record: it does not exist, there are two, the p tag is missing, or a value is invalid. The tags table underneath shows every tag in the record with its meaning, so you can check the record against what you intended.

Common fixes

• No record: start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. That blocks nothing but tells you who is sending as your domain. The beginner's guide to DMARC policy explains the tags.
• Stuck on p=none: read the reports for two weeks, fix any legitimate sender that fails, then move to quarantine and finally reject. Follow the 30-day plan from none to reject.
• Reports to another domain are dropped: the receiving domain needs a TXT record at yourdomain.com._report._dmarc.theirdomain.com containing v=DMARC1. Most report services set it up; check their instructions.
• Reports arrive but make no sense: how to read DMARC reports walks through the XML.

Questions

Do I need SPF and DKIM before DMARC?

Yes. DMARC decides what happens when SPF and DKIM fail to align with the From domain, so without at least one of them passing, every message fails. Check the SPF record first and make sure your mail provider signs with DKIM for your domain.

Will p=reject block my own mail?

Only mail that fails alignment, which is why you run p=none first and read the reports. The usual casualties are website forms, CRMs and newsletter tools sending as your domain without DKIM; fix those before moving up.

Is anything stored?

No. The lookups run in your browser against public DNS over HTTPS. OquMail never sees the domains you check.