Skip to content
DomainGrade

What we checkEmailEM-04

DMARC record

DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and where to send reports about it.

Area
Email
Check
EM-04
Included
Free in every scan

What we check

We look up the TXT record at _dmarc.yourcompany.com and check it begins with v=DMARC1.

Why it matters

SPF and DKIM answer 'was this authorised?'. Only DMARC answers 'and what should I do about it?'. Without it, a receiver that detects a forgery has no instruction from you and will usually deliver the message anyway.

DMARC is also the only one of the three that checks the From address your recipient actually sees.

DMARC is also what makes the other two records add up to something. SPF and DKIM each authenticate a different part of a message, and neither of them checks the address a person actually reads — DMARC requires that the visible From domain aligns with whatever was authenticated, which is the property a forgery cannot satisfy.

How to fix it

  1. 1

    Publish a TXT record at _dmarc on your domain.

  2. 2

    Start with p=none and a rua= address so you can see who is sending as you without affecting delivery.

  3. 3

    Move to p=quarantine, then p=reject, once the reports show only senders you recognise.

A TXT record at _dmarc.yourcompany.com
_dmarc.yourcompany.com.  IN TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@yourcompany.com"

Common questions

How long should I stay at p=none?
Long enough to see a full billing cycle of your own mail — usually two to four weeks. p=none protects nobody, so it is a stage, not a destination.
Do I need a separate DMARC record per subdomain?
No. The record on your domain covers subdomains unless you override it with sp=. If subdomains never send mail, sp=reject is a good default.
Will DMARC stop all phishing?
It stops forgery of your exact domain. It does not stop lookalike domains — yourcompаny.com with a Cyrillic character is a different domain and has its own DMARC. Certificate transparency monitoring is what catches those.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks