Is your domain's DMARC policy enforcing?
Enter a domain to see whether it publishes a DMARC record, which policy it sets, and what that means for mail forged in its name.
Last reviewed
DMARC tells receivers what to do with forged mail.
DMARC (RFC 7489) is a TXT record at _dmarc under your domain. It tells receiving mail servers what to do with a message that uses your domain in the From address but fails authentication. The policy you publish decides what a scan reports:
- No recordHigh70
- p=noneMedium55
- p=quarantineNo finding
- p=rejectNo finding
The check reads the p tag in your record.
A typical record:
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc-reports@example.com"
The tags that matter most:
| Tag | What it sets |
|---|---|
p | The policy for the domain itself: none (deliver and report), quarantine (treat as suspicious, usually spam) or reject (refuse the message). |
sp | The policy for subdomains. Without it, subdomains follow p. |
pct | The share of failing mail the policy applies to. Without it, 100%. |
rua | Where receivers send daily aggregate reports about mail sent as your domain. |
The check scores whether a record exists and which policy it sets. sp, pct and rua are not scored separately, so read them in your own record too: a missing rua means you get no reports, and a low pct means most failing mail is still delivered.
Each policy maps to one of three results.
| What the scan finds | Finding | Severity |
|---|---|---|
| No DMARC record | DMARC record missing | High70 |
p=none | DMARC policy set to none | Medium55 |
p=quarantine or p=reject | No DMARC finding |
Severity runs from 0 to 100. A missing record is the more serious result, because receivers have no policy from you at all. p=none is a record that exists but asks receivers to take no action, so forged mail is still delivered.
This is how the p=none finding appears in a report:
Email security · Medium severity
DMARC policy is set to none
- What was tested
- The DMARC record published at
_dmarc.example.com. - Why it matters
- Without an enforcing policy, anyone can send mail that appears to come from your domain.
- Impact
- Phishing and invoice fraud in your name, aimed at your customers and staff.
- How to fix it
- Monitor DMARC reports, then move the policy from
p=nonetop=quarantineand on top=reject.
p=none is a starting point.
Publishing p=none with a rua address is the right first step, because the reports show every service that sends as your domain. Staying there leaves the domain open to spoofing. The way forward is to get every legitimate sender aligned through SPF or DKIM, then move to p=quarantine and on to p=reject in stages. The guide How to move DMARC from p=none to p=reject walks through each step.
No record at all? Start with a monitoring record and a report address:
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
It reads DNS, not your reports.
- One reading at one point in time. The check reads the record as it is published when the scan runs.
- No aggregate reports. TrustSek does not receive or read the reports your
ruaaddress collects. pctis not weighed. A record atp=quarantine; pct=10already clears thep=nonefinding, although most failing mail is still delivered.- The strictest policy in the record counts. A record with
p=none; sp=rejectis read as enforcing and raises nop=nonefinding. Check thatpitself is where you want it.
“No finding” means the published policy asks receivers to act. It does not prove every sender is aligned, or that the domain cannot be spoofed.
DMARC is one of many checks in a scan.
DMARC is one part of the email security module, which also reads SPF, DKIM, MTA-STS, TLS reporting, CAA, DNSSEC and nameserver redundancy. The full check covers all six modules in the same 30-second scan.
The SPF check explains the SPF results, and the methodology explains how findings become a score.