DMARC Checker

DMARC ties together the two checks it depends on, SPF and DKIM, into one enforceable policy for what happens when a message fails either one.

DMARC (Domain-based Message Authentication)

A DNS TXT record that tells receiving mail servers what to do when a message fails SPF and/or DKIM (the two underlying checks that verify a sender and that a message wasn't altered) - reject it outright, quarantine it (usually spam), or just monitor and deliver it anyway. Also where authentication reports get sent.

Policy (the "p" tag)

The core setting: reject (unauthenticated mail is rejected outright), quarantine (flagged, usually sent to spam), or none (delivered normally - monitoring only, no real protection).

Alignment (adkim/aspf)

How strictly the domain in the visible "From" address has to match the domain that actually passed SPF or DKIM. Relaxed (the default) allows a subdomain match; strict requires an exact match.

Reports (rua/ruf)

Aggregate reports (rua) are periodic summaries of authentication activity across all mail claiming to be from the domain - the main way an owner monitors this. Forensic reports (ruf) would cover individual failures, but are rarely honoured by mailbox providers today.

Why this matters

Without a DMARC policy, anyone can send email that appears to come from your domain - a common tactic in phishing - and receiving servers have no instruction on what to do about it. A properly enforced policy closes that gap.

Check the records DMARC depends on: SPF Checker and DKIM Checker.