DMARC checker

DMARC ties SPF and DKIM together and tells receiving servers what to do when neither one passes. The three records are checked as a set here, because a DMARC policy on its own does nothing useful if the two underneath it are misconfigured.

• p= is the policy and the single most important value on the page. p=none monitors and delivers everything anyway, which means you are collecting data but nobody is protected yet. p=quarantine sends failures to spam. p=reject refuses them at the door and is the only setting that actually stops someone spoofing your domain.
• rua= is where aggregate reports are sent. Without it you are enforcing blind, with no way to see who is sending as you or what is failing.
• pct= applies the policy to a percentage of mail. Anything under 100 is a partial rollout, and it is easy to leave one behind and assume you are protected.
• sp= is the subdomain policy. If it is missing, subdomains inherit the main policy, which is usually what you want but is worth setting deliberately.
• The SPF section expands your whole include chain and counts the DNS lookups it costs. This is the check most tools skip, and it is the one that silently breaks mail.
• DKIM selectors are probed against the common names used by major providers. Not finding one does not prove DKIM is missing, only that it is not on a name we guessed.

• Stuck on p=none forever. Monitoring mode is meant to be a phase, not a destination. A domain on p=none is exactly as spoofable as a domain with no DMARC record at all. Read the reports, fix what legitimately fails, then move to quarantine and then reject.
• More than 10 SPF DNS lookups. RFC 7208 caps the include chain at 10. Go over and receiving servers return a permanent error, which means SPF fails for all of your mail, including the legitimate kind. Every SaaS tool you authorise adds to the count, so this creeps up over years and then breaks at once. Flatten includes or drop senders you no longer use.
• +all or ?all on the SPF record. +all authorises the entire internet to send as you, which is worse than having no SPF record. ?all is neutral and protects nothing. Use -all once you are confident the record is complete, or ~all while you are still verifying.
• Two SPF records. A domain may publish exactly one. Two produce a permanent error. This usually happens when a new provider is onboarded and adds its own record instead of merging into the existing one.
• Alignment, not just passing. DMARC requires the domain that passed SPF or DKIM to match the visible From address. Mail sent through a third party can pass SPF on the provider's own domain and still fail DMARC, which is why a green SPF result is not the whole answer.