What is DMARC?
DMARC combines SPF and DKIM to decide what to do with spoofed From addresses. The record is TXT at _dmarc.domain: v=DMARC1; p=…
This tool shows p=/sp=/rua=/ruf= and alignment tags. BIMI usually needs quarantine or reject. Queries leave from this host.
Examples
- Start
v=DMARC1; p=none; rua=mailto:dmarc@domain.comCollect reports without blocking.
- Enforce
p=reject; pct=100After sources align.
Is SPF enough?
No. If envelope-from and From differ, SPF may not align; DMARC requires alignment. none → quarantine → reject. Jumping to reject can kill real newsletters.
Examples
- ruf
rarely sent nowrua is enough.
- Subdomains
sp=rejectHarden subs while p=none on the apex.
Frequently asked questions
Is SPF enough without DMARC?
No. SPF can fail alignment when envelope-from differs. DMARC requires alignment.
What is rua for?
A mailto: address that receives XML reports of who tried to send as you.
How do I move from none to reject?
Watch reports, put sources on SPF/DKIM, then quarantine, then reject. Jumping to reject can drop real mail.
What is ruf?
Forensic failure reports. Many receivers no longer send ruf; rua is enough.
Are subdomains covered?
Without sp=, p= applies to subdomains too. Use sp= or a separate _dmarc for a different policy.
Does BIMI need DMARC?
Yes. BIMI usually wants enforce (quarantine/reject) DMARC.
Deeper RUA check?
Use DMARC RUA / Inbox for external auth, XML summary and inbox readiness.