SuperMailOS
Start free

Free tool · no signup

Check your DMARC record, in plain English.

We find the policy that applies to your domain, explain every tag in it, check that report addresses are allowed to receive your reports, and tell you the next step toward full protection.

01 Reading a DMARC record

Three parts that matter most.

A DMARC record is a short list of tag=value pairs at _dmarc.yourdomain. Most of the protection comes down to three of them.

p= is the policy

none only monitors, quarantine sends failing mail to spam, reject refuses it. Protection against spoofing starts at quarantine and is complete at reject.

rua= is your visibility

Aggregate reports arrive daily from Gmail, Yahoo, Microsoft and others, listing every server that sent as your domain and whether it passed. Without rua you're tightening the policy blind.

Alignment is the catch

DMARC passes only when SPF or DKIM passes for a domain that matches the From address. A newsletter tool that signs with its own domain passes DKIM but still fails DMARC.

02 Questions

Common questions.

Something else? Write to us — a real person answers, usually the same day.

Talk to us
What should my DMARC policy be?+
Start with p=none and a rua address so you can see who sends as you. Once the reports show all your real mail passing, move to p=quarantine, then p=reject. Reject is the only setting that stops forged mail being delivered at all.
What does pct mean?+
pct is the percentage of failing mail the policy applies to. The rest is handled one step softer: quarantine becomes none, reject becomes quarantine. It's a ramp for cautious rollouts; leave it at 100 (or omit it) once you're confident.
Why do my reports go to another company's address?+
Many teams send reports to a DMARC reporting service. That's fine, but the receiving domain must publish a record authorising it to get reports for your domain, or many providers won't send them. The checker tests for that record.
Does a subdomain need its own DMARC record?+
No. If mail.yourdomain has no record, receivers use the one on yourdomain, applying its sp= policy (or p= when sp is absent). Give a subdomain its own record only when it needs a different policy.

03 More free tools

Keep checking.

Each tool answers one question about a domain's email. All free, no signup.

All free tools ▶
Authentication→

Spoofing checker

A straight verdict on whether a domain's From address can be forged, and how to close the gap.

Authentication→

SPF checker

Unrolls every include and counts lookups against the 10-lookup limit, with a corrected record.

Authentication→

BIMI checker

Record, DMARC enforcement, SVG Tiny PS logo and VMC/CMC certificate, checked together.

Full protection, minus the guesswork.

Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.

Start free Talk to us