Skip to main content
PPenTesting.org

Check your DMARC policy and stop spoofed email

Enter your domain to see your DMARC policy, whether reports are switched on, and how your SPF and DKIM support it. You get the next record to publish for your current step.

Reads public DNS records only, the same ones every mail server reads. We do not keep your domain or the results. Own a domain and want it left out? Publish a TXT record reading exclude at _pentesting-org.yourdomain.

How a receiving mail server checks your domainYour mail server sends a message. The receiving server looks up your public DNS records and asks: SPF or DKIM passed and matched? The message is then delivered, sent to spam or rejected.Your mail serversends as example.commessageReceiving serverDMARC checkDNS lookupTXT at _dmarc.example.comv=DMARC1; p=quarantineInboxSpamRejectedSPF or DKIM passed and matched?
Every receiving server asks the same question of your public DNS. This check reads the same records.

Three steps from monitoring to reject

DMARC is meant to be tightened in stages. Each step is one change to the same TXT record, and the reports tell you when it is safe to take the next one.

The three DMARC policy stepsStart at p=none to collect reports, move to p=quarantine, then p=reject.Monitorp=noneQuarantinep=quarantineRejectp=reject
Monitor: Reports only. Find every service that sends as you.Quarantine: Failing mail goes to spam.Reject: Failing mail is refused outright.

What has to be true before you enforce

  • Every service that sends as you (your mailbox provider, newsletter tool, CRM, help desk, invoicing) passes SPF or DKIM.
  • The domain they authenticate with matches the “From” address your recipients see. DMARC calls this alignment.
  • Your reports have shown only those services passing, for at least a few weeks.

Questions

What does DMARC do?

DMARC tells receiving servers what to do with mail that claims to be from your domain but fails SPF and DKIM: deliver it, send it to spam, or reject it. It also asks them to send you reports, so you can see every service sending as you.

What is the difference between p=none, p=quarantine and p=reject?

p=none only collects reports; spoofed mail is still delivered. p=quarantine sends failing mail to spam. p=reject refuses it. Most organisations start at none, read the reports for a few weeks, then move up.

Is p=none safe to publish?

Yes. It changes nothing about how your mail is delivered. It is the right first step, but it does not stop anyone spoofing you, so treat it as a starting point rather than the finish.

Where do DMARC reports go?

To the address in the rua tag of your record. They arrive as XML files, usually daily, from large mailbox providers. A report reader makes them easier to use, but you can start with a normal mailbox.

My subdomain has no DMARC record. Is it covered?

Usually, yes. When a subdomain has no record of its own, receivers use the record on the main domain. This check shows when a policy is inherited that way.

More email checks

Email security checker (all checks) →SPF checker →DKIM checker →

PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.