cnames.dev / tools / dmarc checker
DMARC Checker
Look up your DMARC record, grade the policy, and get a plain-English explanation of every tag.
What DMARC does
DMARC (Domain-based Message Authentication, Reporting & Conformance) lets a domain owner tell receiving servers how to handle mail that fails authentication, and where to send reports. It sits on top of SPF and DKIM: a message passes DMARC when it passes either SPF or DKIM and that authenticated domain aligns with the visibleFrom address.
The policy ladder
p=none— monitor and report only. Nothing is blocked; use it to gather data.p=quarantine— failing mail goes to spam/junk.p=reject— failing mail is rejected outright. This is the goal.
The safe rollout is: publish p=none with a rua report address, read the reports until you're confident all legitimate senders align, then move to quarantine and finallyreject, optionally ramping with pct.
Common DMARC mistakes
- Staying on
p=noneforever — it never actually blocks spoofing. - No
ruaaddress, so you fly blind. - Alignment failures because SPF/DKIM authenticate a different domain than the
Fromheader.
Building a SaaS that needs custom domains? cnames.dev automates DNS, SSL, and edge routing — one API call per domain, free for 25 domains. Start free or read the docs.
Frequently asked questions
What is a DMARC record?
A DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment — monitor (none), quarantine, or reject — and where to send reports.
What is the difference between p=none, quarantine, and reject?
p=none only monitors and reports; it does not stop spoofing. quarantine sends failing mail to spam. reject blocks it outright. The goal is to reach p=reject once you have confirmed your legitimate senders pass.
Do I need SPF and DKIM for DMARC to work?
Yes. DMARC builds on SPF and DKIM: a message passes DMARC if it passes either one AND the passing domain aligns with the From domain. Set up SPF and DKIM first, then DMARC.
What is rua?
The rua tag sets the address that receives daily aggregate reports (XML). Without it you get no visibility into who is sending as your domain, so it is strongly recommended.