DMARC
This checker reads the DMARC TXT record at _dmarc.yourdomain.com and passes only if the policy is set to quarantine or reject, since p=none or a missing record asks receivers to do nothing about mail that fails authentication.
Questions
DMARC is a TXT record at _dmarc.yourdomain.com that sets policy for mail failing SPF and DKIM alignment: p=none (deliver anyway), p=quarantine (junk it), p=reject (refuse it). p=none is monitoring mode: useful for the first month, an open door after that. Anyone on earth can send as a p=none domain and receivers will do nothing.
Since February 2024, Google and Yahoo require DMARC for bulk senders. Without it, volume sending to those inboxes gets throttled or junked regardless of how good the mail is.
rua=mailto:... tells receivers where to send aggregate reports of who is sending as your domain. Without it, nobody is watching: you cannot see spoofing, and you cannot safely move from p=none to p=reject because you cannot see what would break.
pct applies the policy to a percentage of mail: pct=25 means spoofers get a free pass three times out of four. sp sets a separate policy for subdomains; sp=none under a strict p= is the gap attackers actually use.
A pass means your domain publishes a DMARC record at _dmarc.yourdomain.com with a policy of quarantine or reject, so mail failing SPF and DKIM alignment gets junked or refused instead of delivered anyway.
A failure means your domain has no DMARC record, or has one set to p=none, which asks receivers to do nothing about mail that fails authentication, including mail from anyone spoofing your domain.
Publish a DMARC record with a rua address so you can see what is sending as your domain, start at p=none only while you set that up, then move to p=quarantine and on to p=reject once the reports show legitimate mail is passing.
Free
Paste it, and the rule-set from 4,000,000 sends scores it. The report lands in your inbox in minutes, and a full three-step sequence written for your ICP follows from Hugo a few hours later.
EMPRA