Stops impersonation
At enforcement, DMARC instructs receivers to quarantine or reject mail that fakes your domain — the core defence against BEC.
Free Email Tool
DMARC Checker
DMARC is the policy that tells the world what to do with mail that fails to prove it came from you. Moved to enforcement, it stops criminals spoofing your domain. This guide explains the policy, alignment and reporting to look for — and a specialist will check yours for you, free.
Information:
Automated checker coming soon
What this tool checks
What a healthy DMARC record looks like.
A DMARC check reads the policy record on your domain and how it is configured. These are the parts that decide whether you are actually protected.
-
A valid DMARC record exists
Your domain should publish a DMARC TXT record at _dmarc, beginning with "v=DMARC1".
-
The policy is enforced
The policy (p=) should be moving towards "quarantine" or "reject" — "none" only monitors and does not stop spoofing.
-
Alignment is configured
DMARC passes only when SPF or DKIM passes and aligns with your visible from-address — alignment is what makes it meaningful.
-
Reporting is turned on
An "rua" address collects aggregate reports so you can see who is sending as you before you tighten the policy.
-
The percentage and options fit
Settings like "pct" and subdomain policy should match where you are in your rollout, not be left at risky defaults.
-
It is staged, not rushed
A healthy DMARC journey moves from monitoring to enforcement only once every legitimate sender is authenticated and aligned.
Why it matters
DMARC is what actually stops spoofing.
SPF and DKIM prove authenticity; DMARC tells receivers to act on it. Without DMARC at enforcement, your domain is open to impersonation.
Protects your reputation
Stopping forged mail in your name protects how the inbox — and your clients — perceive your domain.
Gives you visibility
DMARC reports reveal every service sending as you, including ones you forgot about or never authorised.
Common problems
The DMARC mistakes we see most.
DMARC is powerful but easy to get wrong — either too weak to help, or too strict too soon and blocking your own mail.
-
Stuck on p=none forever
Monitoring is the start, not the destination. A policy left at "none" never actually stops spoofing.
-
Enforced before alignment is ready
Jumping to "reject" while legitimate senders still fail alignment blocks your own genuine mail.
-
No reporting address
Without an rua address you are blind to who is sending as you, so you can never safely tighten the policy.
-
Forgotten third-party senders
A newsletter or invoicing tool that is not aligned will fail DMARC, so its mail breaks when you enforce.
Preview the checker
Check a domain's DMARC record
This is a preview of the automated DMARC checker we are building. It does not run a live lookup or store anything you type.
Coming soon
Automated checking is on its way. A human audit is available now.
We are building instant, automated checkers as part of our Email Operations Center roadmap. Until then, a specialist will run this check by hand as part of a free Email Audit — and explain what it means for your business in plain English, with no jargon and no obligation.
- A real specialist reviews your setup — not an automated guess.
- Plain-English findings and the next step that actually matters.
- Free, with no obligation — we work alongside your existing IT.
Questions
Answers, in plain English.
What is DMARC, in plain English?
DMARC is the policy that tells receiving mail systems what to do with messages that fail the checks proving an email genuinely came from you. Moved to enforcement, it instructs them to quarantine or reject impersonations — so spoofed mail in your name stops being delivered.
What does p=none, p=quarantine and p=reject mean?
"none" only monitors and takes no action; "quarantine" sends failing mail to spam; "reject" blocks it outright. You typically start at "none" to gather data, then move to "quarantine" and finally "reject" once every legitimate sender passes — this staging is what keeps real mail safe.
What is DMARC alignment?
Alignment means the domain that passed SPF or DKIM matches the domain your recipients actually see in the From address. DMARC only passes when there is a pass with alignment — it is the detail that makes DMARC meaningful rather than easy to fake.
Will turning on enforcement break our email?
Not when it is staged properly. We authorise and align every legitimate sender first — including third-party tools — and verify it with aggregate-report monitoring before moving to enforcement, so genuine mail keeps flowing while impersonations are blocked.
Does this tool check my DMARC live?
Not yet — the automated checker is in development. This page explains DMARC and what a healthy setup looks like, and the form is a preview that does not run a live check. For results today, request a free manual audit.
What if my domain is being spoofed right now?
If criminals are actively impersonating your domain or running a payment-redirection scam, do not wait — request Emergency Email Support and a specialist will act fast to contain it and move you toward enforcement.