DMARC checker and generator

Build a record

Answer two questions — what to do with mail that fails, and where to send reports — and get a ready line.

What DMARC is

SPF and DKIM answer “is this message genuine?”. DMARC answers the second, far more important question: what to do when it is not. It is a record on the _dmarc subdomain holding two things: a policy and a reporting address.

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; fo=1

Why everyone starts at p=none

p=none blocks nothing. That sounds pointless — but it is what turns reports on, and reports show what you do not know: who else sends mail as your domain. There is almost always a forgotten CRM, an old mailing service or a script on a server that only a departed colleague remembered.

Jumping straight to p=reject throws their mail away the same day, before you learn they existed. The right path: none → collect reports for two or three weeks → add what you find to SPF and DKIM → quarantine → reject.

Alignment: why DMARC fails with valid SPF and DKIM

Its least obvious part. DMARC requires the domain that passed SPF or DKIM to match the domain in the From header. A message from you@company.com sent through a mailing service with its own envelope passes SPF — but it is the service's domain that passed, not yours. SPF=pass, DMARC=fail.

The cure is a DKIM signature with your own domain; nearly every service lets you add your key. Our header analyzer shows this: check whether d= in the signature matches the From domain.

What Gmail and Yahoo require

Since 2024, senders of more than 5000 messages a day need SPF, DKIM, DMARC (at least p=none), a List-Unsubscribe header with one-click opt-out, and a complaint rate below 0.3%. This is not advice: without them mail is simply not accepted.

Other checks

All three work without signing up and store nothing. For the bigger picture on deliverability see staying out of spam and Gmail limits.