DMARC record and policy

What this check looks at

Authentication group · check id dmarc.record · all thirteen checks

“DMARC tells receivers what to do with mail that fails SPF and DKIM: none, quarantine or reject.” - the wording shown beside this check while it runs.

DMARC ties SPF and DKIM together and adds the part neither has: an instruction. It is published at _dmarc.yourdomain.com and its p= tag is the whole point.

p=none

Do nothing. Deliver the message as normal and, if asked, send a report. This blocks no forgery whatsoever.

p=quarantine

Treat failing mail as suspicious - in practice, put it in the spam folder.

p=reject

Refuse failing mail outright. It never reaches the recipient at all.

DMARC also requires alignment: it is not enough for SPF or DKIM to pass for some domain, it has to pass for your domain - the one the reader sees in the From line. That is the gap forgery lives in.

Why it matters

A domain on p=none is not protected. It is the most common finding there is: a record exists, so the domain looks configured, and every forged message is still delivered exactly as before. p=none is a legitimate starting position while you find your senders - it is a bad place to stop, and most domains stop there.

Going straight to p=reject is the opposite mistake. Any legitimate sender that is not authenticating properly stops being delivered, and you find out from the customer who never got the invoice.

What each verdict means here

Pass

A valid DMARC record with an enforcing policy - quarantine or reject.

Warn

A record exists but it is on p=none, or it has syntax that will not do what you intended.

Fail

No DMARC record, or one that does not parse.

What to do

1. If there is no record, publish one at _dmarc.yourdomain.com starting at p=none with a reporting address. On its own this changes nothing about delivery, so it cannot break your mail.
2. Collect reports until you can account for every legitimate sender, and fix each one so it passes SPF or DKIM aligned to your domain.
3. Then move to p=quarantine, watch, and then to p=reject.
4. Do not skip the middle. The reports are how you find out whether the next step is safe.

What this check does not do

We read your policy. Collecting the reports that tell you whether enforcement is safe is on the roadmap and is not built yet, and this product never changes a DMARC policy for you - enforcement is always an explicit human decision.