DMARC Checker

It is a TXT record published in the domain's DNS, under the _dmarc label, that tells mail servers what to do when a message claims to come from your domain but fails both SPF and DKIM checks. Without DMARC, anyone can spoof your domain in the sender. With DMARC you tell the world to reject or quarantine those forged emails.

They are the three possible policies. p=none only observes and sends reports, blocking nothing: the starting point for measuring. p=quarantine sends failing mail to the spam folder. p=reject rejects it outright, and is the end goal: it is the only policy that truly stops your domain being spoofed.

DMARC is not satisfied with SPF or DKIM merely passing: it requires that the domain they validate matches the domain visible in the sender (the From). That is alignment. It stops someone passing their own authenticated domain off as yours. It can be strict (identical domain) or relaxed (same organisational domain), controlled by the adkim and aspf tags.

No. With p=none, emails spoofing your domain still get delivered; you are only receiving reports on who sends them. It is the diagnostic phase, meant to last a few weeks while you review the rua reports and make sure your legitimate mail passes. Real protection starts when you move up to quarantine and then reject.

rua sets the address that receives aggregate reports: a daily summary of how many messages were sent on your domain's behalf, from which IPs, and whether they passed SPF and DKIM. They are the compass for moving from p=none to p=reject without accidentally blocking legitimate mail. Without rua you are flying blind.