Look up _dmarc.domain and grade the policy (none / quarantine / reject).
Loading tool…
Lower stack cost. Back in the inbox. Built to send at any scale.
We rebuild it properly: secondary domains, inboxes, SPF, DKIM and DMARC set to enforcement, warmup and safe sending limits, blacklist monitoring on top. Send-ready in about 17 days. No campaigns, no copy, no lead lists. Infrastructure only.
Almost a decade building cold outreach infrastructure, including his own sending and verification stack built from scratch. 20+ B2B clients at companies worth $10M and above, all in tier one countries.
Free · Written plan + fixed price · No sales call required
DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF or DKIM checks. Without it, anyone can send as your domain and nothing pushes back. With it set to quarantine or reject, failed mail is filtered or refused. It also sends you reports about who is sending as your domain, which is how spoofing and misconfigured senders get found. Those reports show legitimate services that you forgot to set up, forwarding that breaks checks, and other people trying to use your domain without permission. A good DMARC setup therefore does two jobs at once. It protects your domain name, and it gives you a clear view of every system that sends mail in your name. Start in monitoring mode, fix what the reports show, and then move to a stronger policy.
Here is a complete record for a domain that wants strict handling:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s
v is the version tag. It is always DMARC1, and the record must start with it. A record that does not start with this tag is not treated as a DMARC record at all.
p is the policy tag. It tells receivers what to do with mail that fails the checks: none, quarantine or reject. Reject is the strongest setting and the goal for most domains.
rua is the address for daily aggregate reports. Reports from receivers around the world are sent to this address as XML files, usually once a day. Use a mailbox that you check, or a reporting service that reads the files for you.
pct is the share of failing mail that the policy applies to. A value of 100 means the policy applies to all failing mail. Lower values are used while rolling a policy out in stages.
adkim sets the DKIM alignment mode. The value s means strict, so the signing domain must match the From domain exactly. The value r means relaxed, which allows subdomains to count as a match.
aspf sets the SPF alignment mode and works the same way. Use s for strict if your senders support it, and r for relaxed if subdomains send mail for you.
Every tag in one record, what it means, and its default if you leave it out.
| Tag | What it does |
| v | Version, required, always DMARC1 |
| p | Policy for the domain: none, quarantine or reject |
| sp | Policy for subdomains, inherits p if unset |
| rua | Address for aggregate reports, in mailto format |
| ruf | Address for forensic failure reports, support is limited |
| pct | Percentage of failing mail the policy applies to, default 100 |
| adkim | DKIM alignment mode, r for relaxed or s for strict, default r |
| aspf | SPF alignment mode, r or s, default r |
| fo | When forensic reports are generated: 0, 1, d or s, default 0 |
| ri | Report interval in seconds, default 86400 |
You can check any domain in under a minute with the tool at the top of this page.
These five problems cause most of the failures this checker reports.
The record lives at _dmarc.yourdomain.com as a TXT record, not on the root domain. Publish it there, with the name _dmarc, and check that your DNS host saved it as a single TXT value.
None is monitoring only and stops nothing. Move to quarantine once your legitimate senders pass alignment, watch the reports for a short period, and then move to reject for full protection.
The domain in the From header must match the SPF or DKIM domain. Relaxed mode allows subdomains to count as a match, while strict mode requires an exact match, so check which mode your record uses.
Receivers treat that as no valid record and ignore both of them. Delete one record and keep a single record that holds your current policy and report addresses.
The rua tag must hold a valid mailto address that can receive mail. An address on a different domain only works if that domain publishes an authorization record for your domain, so add that record or use an address on your own domain.
A DMARC record is a DNS TXT record that sets the policy for mail that fails SPF and DKIM checks for your domain. It tells receivers whether to deliver, filter or refuse that mail, and where to send reports about it.
It lives in DNS at _dmarc followed by your domain, for example _dmarc.example.com. It is published as a TXT record on that subdomain, not on the root domain itself.
With p=none, failing mail is still delivered and you only get reports. With quarantine, failing mail is treated as suspect, usually by sending it to spam. With reject, failing mail is refused at delivery and never reaches the inbox.
Receivers start using the record as soon as they can see it in DNS. That is often within an hour, but it can take up to a day while old DNS answers are cached around the world.
It can if a policy of quarantine or reject is set before all of your real senders pass alignment. Mail from a service that is missing from SPF, or that does not sign with an aligned DKIM domain, can be filtered or refused. Publish with p=none first and fix senders before you enforce.
Yes. Cold email is sent from your domain, so it is checked in the same way as any other mail. A missing or weak DMARC record makes spoofing easy and can hurt trust in your domain, which affects whether your own mail lands in the inbox.
Alignment means the domain that SPF or DKIM checks is the same as the domain shown in the From header that people see. In relaxed mode a subdomain can match its root domain. In strict mode the match must be exact.
Those reports are normal. Large mailbox providers send daily aggregate reports to the rua address in your record, covering mail they received that claimed to be from your domain. The reports list sending sources, volumes, and whether the mail passed or failed the checks.
Receivers treat a domain with two DMARC records as a domain with no valid record, so your policy is ignored. Keep one single record, update that record when you need a change, and delete any old copy.
It covers what is broken, what we would build, the timeline, and one fixed price. Want it walked through instead? Book a 15 minute plan walkthrough.
Or just reply to the plan email. Either works.
