What DMARC does
DMARC ties SPF and DKIM to the visible From address and tells receivers what to do when neither aligns: nothing (p=none), spam folder (p=quarantine) or reject. It also asks receivers to send aggregate reports (rua) that show every source sending as your domain. Gmail, Yahoo and Microsoft require DMARC for bulk senders.
The path to enforcement
- Publish p=none with a rua address.
- Fix every legitimate sender that fails alignment (the reports show them).
- Move to p=quarantine with pct=25, then 100.
- Move to p=reject.
Our DMARC generator builds the record; on paid plans, monitoring parses the reports and tells you when each step is safe.
DMARC checker: questions
What is the difference between p=quarantine and p=reject?+
p=quarantine asks receivers to treat mail that fails DMARC as suspicious, usually by delivering it to the spam folder; p=reject asks them to refuse it during the SMTP transaction, so it never reaches the mailbox. p=none asks for no action and only collects reports. Receivers can still apply local policy, but p=reject is the strongest protection against spoofing.
What happens if a domain has two DMARC records?+
Receivers ignore DMARC for the domain. RFC 7489 §6.6.3 says that when _dmarc returns more than one v=DMARC1 record, policy discovery stops and no DMARC policy is applied, so you lose both enforcement and reports. Keep exactly one TXT record at _dmarc.example.com and put every tag you need into it.
Does a DMARC policy cover subdomains?+
Yes, unless a subdomain publishes its own record. Receivers that find no DMARC record at _dmarc.sub.example.com fall back to the organizational domain's record and apply its sp= policy, or its p= policy when sp= is absent. Setting sp=none under an enforcing p= leaves every subdomain open to spoofing, which the checker flags.
Why do I need DMARC if I already have SPF and DKIM?+
Because SPF and DKIM alone do not protect the From address people see. SPF validates the envelope sender and DKIM validates whichever domain signed, and both can pass for an attacker's own domain. DMARC requires one of them to pass for a domain aligned with the From domain, tells receivers what to do when neither does, and sends you reports.
Can DMARC reports go to an address at another domain?+
Yes, if that domain authorises it. When rua= points outside your domain, receivers look for a TXT record containing v=DMARC1 at yourdomain._report._dmarc.otherdomain, for example example.com._report._dmarc.reports.example.net, and skip the address if it is missing (RFC 7489 §7.1). DMARC reporting services usually publish this record for their customers.
Why does the DMARC checker still show my old record?+
Because DNS answers are cached. Resolvers, including the one the checker uses, keep the old record until its TTL runs out, and the checker caches each result for ten minutes on top. Confirm the new value at your DNS host, then check again after the old record's TTL has passed; a brand-new record can take longer if a resolver cached its absence.