DMARC Record
Parse every DMARC tag and verify external report destination authorization.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is DMARC Record?
The DMARC tool parses every tag in the _dmarc.<domain> record (p, sp, pct, rua, ruf, adkim, aspf, fo, ri) and explains what each one does. If a subdomain has no record of its own, the organizational domain's policy is inherited and that is called out explicitly.
DMARC closes the gap SPF and DKIM leave open: neither protects the From header the user actually sees. DMARC requires the From domain to align with SPF or DKIM, which is what stops your domain being spoofed.
It also verifies external report authorization under RFC 7489 §7.1: if your reports go to another domain, that domain must publish consent. Without it receivers silently don't send the reports — you may believe you're receiving them when you aren't.
Frequently Asked Questions
11 questionsWhy do I need DMARC if I already have SPF and DKIM?
SPF validates the envelope (Return-Path) domain, DKIM validates the signing domain. Neither protects the From header the user actually sees — an attacker can pass SPF/DKIM with their own domain while putting yours in From. DMARC closes that gap by requiring the From domain to align with SPF or DKIM.
Which policy should I start with?
Start at p=none with a rua address. Collect reports for at least two weeks, confirm every legitimate sender aligns, then move to quarantine and finally reject. Jumping straight to reject without reports risks cutting off your own mail.
What's the difference between strict (s) and relaxed (r) alignment?
Relaxed accepts subdomains: a signature from billing.example.com aligns with an example.com From. Strict requires an exact match. Relaxed is right for most setups; strict breaks things once you delegate subdomains to third-party services.
My report address is on another domain — do I need anything extra?
Yes. Per RFC 7489 §7.1 the receiving domain must consent: it needs a TXT record containing v=DMARC1 at <your-domain>._report._dmarc.<report-domain>. Without it receivers silently don't send the reports — you may believe you're receiving them when you aren't.
What does pct below 100 do?
The policy applies only to that share of messages; the rest is treated as if no policy existed. Useful for a staged rollout (10% → 50% → 100%), but remember to drop the tag when you're done or protection stays partial.
Are my subdomains protected?
Without an sp= tag they inherit the main policy, so yes. Setting sp=none leaves subdomains completely unprotected — attackers can spoof non-existent ones like billing.example.com.
How long does raising the policy take?
A healthy rollout is usually 4-8 weeks: two weeks at p=none collecting reports, aligning senders, a few weeks at quarantine, then reject. The cost of rushing is legitimate mail being cut off unnoticed.
I see unfamiliar IPs in the reports — is that spoofing?
Not necessarily. It's usually a forgotten service: invoicing, CRM, a monitoring tool, an old server. Identify the source first — align it via SPF/DKIM if legitimate, block it by raising the policy if not.
What exactly does pct sample?
The share of messages the receiver enforces on. At pct=25 a receiver applies the policy to a quarter of messages and treats the rest as if no policy existed. The sampling happens receiver-side; you can't choose which messages.
What is the np tag for?
It sets a separate policy for non-existent subdomains — those with no MX or A record. Attackers frequently use names like billing.yourdomain.com that never existed; np=reject closes that directly.
Can I use a third-party service as the report address?
Yes, and it's common — the XML is painful to read by hand. The service gives you its own rua address; because it's on a different domain, that domain must publish the authorization record. Services normally publish it for you.