DMARC check: is your DMARC policy enforced and reported?
How does this check work, and what does the result tell you?
Enter your domain and AdminKit's free tool parses its DMARC record (p, sp, rua, ruf, pct, adkim, aspf), explaining in plain language what happens to mail that fails SPF or DKIM alignment and whether aggregate or forensic reports are configured, so you can see today whether DMARC is enforced or only monitoring.
Part of the Email authentication cluster — more tools, guides and terms on email authentication.
AI explanation Run a check below, then sign in to ask AI to explain the result in plain language.
What the result means
Start at p=none to gather rua reports before moving to quarantine or reject, so enforcement does not block legitimate mail you forgot was sending on your behalf.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up when this result changes? Talk to our team and we'll set it up for you.
How it works and limits
This tool fetches the TXT record at _dmarc.<your domain>, parses its tags with AdminKit’s own code, and explains
each one in plain language. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers
what to do with mail that fails SPF or DKIM alignment, and asks them to report back on what they saw, as defined in
RFC 7489. See dmarc.org’s overview for a
non-RFC explanation of the same policy and reporting concepts.
Reading the tags
p is the headline policy for the domain itself (none, quarantine, reject); sp can set a different policy for
subdomains. pct rolls out enforcement gradually by applying the policy to only that percentage of failing mail.
rua and ruf are reporting addresses — aggregate (daily summaries) and forensic (per-message, less widely
supported) respectively. adkim/aspf choose strict or relaxed alignment between the visible From: domain and the
domain that actually passed SPF/DKIM.
A sensible rollout path
Most domains start at p=none to collect rua reports without affecting mail delivery, confirm every legitimate
sending source is accounted for, then move to p=quarantine and eventually p=reject once confident nothing
legitimate will be blocked.
Limits
- This checks whether the record itself is well-formed, not whether your mail flow would actually align — only
real reports (
rua) show that. - No query is logged; see /legal/privacy/.
This tool diagnoses a record that already exists; if your domain has none yet, or you want to build the next step in
the rollout (say, moving from p=none to p=quarantine), AdminKit’s DMARC record generator
builds the TXT record string for you to publish.
See SPF, DKIM and DMARC explained for how the three records work together,
with real record examples. If you already publish rua and are ready to move past p=none, see
reading DMARC aggregate reports and rolling out to p=reject safely. Once reporting is on and the first rua files arrive, AdminKit’s DMARC report analyzer reads a report in your browser and shows each source IP’s volume, SPF/DKIM alignment and applied policy.
Related reference entries: DMARC, BIMI, MTA-STS and
TLS-RPT — see also BIMI, MTA-STS and TLS-RPT explained
and the free SPF/DMARC checker roundup.
Frequently asked questions
What does p=none mean?
p=none means take no action: RFC 7489 defines it as the Domain Owner requesting "no specific action be taken regarding delivery of messages" (RFC 7489 §6.3), while still asking receivers to send aggregate reports. It is a monitoring-only starting policy — one of three p= values (none, quarantine, reject) — not enforcement.
Do I need both rua and ruf?
No, not both: RFC 7489 §6.3 defines rua and ruf as two separate, independent reporting addresses. rua (aggregate reports) is the practical minimum for visibility; ruf (forensic, per-message reports) is optional and less widely supported by receivers.
Does p=none actually block any spoofed mail?
No — none only asks receivers to report, not act. RFC 7489 §6.3 contrasts it with stronger settings: p=quarantine asks receivers to treat failing mail "as suspicious," and p=reject asks them to reject it outright — neither enforcement effect applies while p=none is set. Spoofed mail that fails SPF/DKIM alignment is delivered exactly as it would be without DMARC at all, until the policy moves up.
What's the difference between DMARC alignment and SPF/DKIM simply passing?
Alignment is the extra check that the authenticated domain actually matches what the user sees: RFC 7489 §3.1 defines Identifier Alignment as when "the domain in the RFC5322.From address matches a domain validated by SPF or DKIM." SPF or DKIM alone can pass against a completely different domain than the one shown in the message's visible From: address — without alignment, an attacker could pass SPF for their own domain while spoofing yours in From:.