How to use it

Type the domain in your From address in Domain name and press Check.
Read the Policy line, then the table of tags with What it means for each.
Under Suggested next DMARC record, press Copy record and add it as a TXT record named _dmarc at your DNS host.
Check the grade under Whole email setup and follow the links to fix SPF or DKIM first.

The three policies

Policy	Receivers are asked to	Use it
`p=none`	take no specific action; you get reports	first, while you find every service that sends as you
`p=quarantine`	treat failing mail as suspicious, usually the spam folder	once reports show your own mail passes
`p=reject`	refuse failing mail during delivery	the end goal for most domains

A message passes DMARC when SPF or DKIM passes and its domain aligns with the From address. Relaxed alignment (r, the default) accepts the same organisational domain, so mail.example.com aligns with example.com; strict (s) needs an exact match.

A safe rollout

Google's advice: start with p=none for a week and review the daily reports, then quarantine a small share of failing mail (it suggests 10% for a small organisation, 1% for a large one), raise it to 100%, then consider reject. RFC 9989 is more cautious for domains whose users post to mailing lists: p=none for at least a month, then p=quarantine for as long, before any reject.

The suggested record moves you one step at a time: no record becomes p=none, none becomes quarantine, quarantine becomes reject. It keeps your report address, or adds mailto:dmarc-reports@ your domain, so create that mailbox first. For a domain with p=none the result reads:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r

Tags, and what changed in May 2026

Tag	Meaning	Default / status
`v`	Version, always DMARC1, must come first	required
`p`	Policy for the domain	required
`sp`	Policy for subdomains	same as p
`rua`	Address for daily aggregate reports	none
`ruf`	Address for failure reports	none
`adkim`, `aspf`	DKIM and SPF alignment	r
`fo`	When failure reports are sent	0; ignored without ruf
`pct`	Share of failing mail the policy applies to	removed in RFC 9989
`ri`	Report interval in seconds	removed in RFC 9989

RFC 9989, published in May 2026, replaced RFC 7489 as the DMARC standard. It removed pct, rf and ri, because pct values other than 0 and 100 were applied inconsistently, and added t=y (test mode: receivers apply one level below your policy), np (policy for subdomains that don't exist) and psd. Unknown tags must be ignored, so pct=100 left in an older record does no harm. The checker marks any other pct, rf or ri value as historic: receivers that still follow RFC 7489 may apply a lower pct, new ones ignore it, so the safe move is to remove it and use t=y for testing instead.

How the whole-setup grade works

The grade is our own summary, not an industry score. It starts at 100 and subtracts:

Finding	Points
No DMARC record	−30
No SPF record	−25
`p=none`, or no MX and no null MX	−15 each
Each SPF or DMARC problem	−15
No DKIM key found, or a DKIM key problem	−10
Each SPF or DMARC warning	−5
Each DKIM warning	−3

A is 90 or more, B 80, C 65, D 50, E 30, F below. MTA-STS and TLS-RPT are shown but don't change the score.

Questions

Is p=none enough for the bulk-sender rules?: It meets the minimum: Yahoo and Outlook.com accept at least p=none, and Gmail requires DMARC from bulk senders. Outlook.com has rejected non-compliant mail from domains sending over 5,000 messages a day since 5 May 2025. But p=none still lets spoofed mail through.
Why are two DMARC records a problem?: When more than one DMARC record is found, receivers stop and apply no DMARC at all, so both are ignored. Merge them into one.
Where should DMARC reports go?: To a mailbox or report service someone reads. Aggregate reports are summaries, normally one a day from each receiver that sends them. Yahoo strongly recommends a working rua address while you set up.
Does my DMARC policy cover subdomains?: Yes: p applies to subdomains unless sp sets a different policy for them.
Should I still use pct to roll out slowly?: It's no longer part of the standard. Use t=y for a trial of a stricter policy, or go step by step from none to quarantine to reject while watching the reports.

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.

DMARC checker