Free tool
Which policy you ask for, where the reports go and what the next step towards reject is.
Reference
SPF and DKIM say whether a message is authenticated. DMARC requires it to be authenticated with your domain, the one the recipient sees, and says what to do when it isn't: deliver it anyway, send it to spam or reject it.
The policy
p= says what to do with email that fails: none delivers it anyway and only asks for reports, quarantine sends it to spam and reject rejects it. You start with none and move up a step when the reports show that all your legitimate email passes.
The value of p=
p=none
monitor only: delivered anyway
p=quarantine
to the spam folder
p=reject
rejected: it doesn't arrive
Alignment
A message passes DMARC if it passes SPF or DKIM and, in addition, the domain that passes is the sender domain the recipient sees. A spoofer can pass SPF with their own domain, but can't align it with yours.
An email from tudominio.com
exampleFrom: facturas@tudominio.com
what the recipient sees
DKIM d=tudominio.com
signed by your domain
SPF bounce.proveedor.com
passes, but it's another domain
The reports
With rua, the servers that receive your email send you XML reports (usually daily) showing who has sent with your domain, from which IP and whether it passed. They're what let you move from none to reject without shutting out your own shop or your newsletters. If they go to a mailbox on another domain, that domain has to accept them.
An aggregate report, summarised
example203.0.113.10
your server · 1,204 messages
198.51.100.25
Google Workspace · 380 messages
192.0.2.77
nobody you know · 52 messages
It's a TXT record at _dmarc.tudominio.com that says what to do with email that uses your domain as the sender and doesn't pass aligned SPF or DKIM, and where to send the reports. A record to start with: v=DMARC1; p=none; rua=mailto:dmarc@tudominio.com. Create the reports mailbox first.
Start with p=none: it changes nothing in delivery and you get the reports. When you see that all your legitimate email passes (your mailbox, the website forms, the shop, the newsletters, the invoicing), move up to quarantine and, later, to reject. Skipping steps is the quickest way to get your own invoices sent to spam.
If a subdomain doesn't publish its own _dmarc, the main domain's applies: whatever sp= says or, if it has none, p=. This checker takes that into account: if you type a subdomain without its own record, it shows you the one it inherits and the policy that applies.
First, make sure the record has rua=mailto: with a mailbox that receives email. If that mailbox is on another domain, that domain has to accept the reports by publishing tudominio.com._report._dmarc.otrodominio.com; reporting services do this when you add your domain, and we check it here. Even so, not every server sends reports, nor at the same frequency. If you're already getting them and don't know how to read them, start with our guide to DMARC reports.
Since 2024 Gmail and Yahoo require it from anyone sending them more than 5,000 messages a day, but it's worth it for everyone: without DMARC, nothing tells the receiving server to distrust an email that uses your domain without being authenticated by you. With p=none you risk nothing and start seeing who uses it. To check a real send end to end, try our email test.
