What a DMARC record is
DMARC is a single DNS TXT record published at _dmarc.yourdomain.com. It does two things: it tells mailbox providers what to do with mail that claims to be from you but fails authentication, and it asks them to send you reports on what they saw.
v=DMARC1; p=none; rua=mailto:reports@yourdomain.comThat is a complete, valid record. Everything else is optional refinement. The checker above reads yours live from DNS, along with your SPF record and any DKIM keys it can find, and tells you which of the tags below you have and what they currently do.
What each tag means
v=DMARC1 — the version, and it must come first. A record that starts with anything else is ignored entirely rather than treated as an error.
p= — the policy, and the tag that actually does something. none monitors and asks for reports without changing delivery. quarantine sends failing mail to spam. reject refuses it at the gateway, before it reaches an inbox. Only reject stops someone spoofing your domain; the other two are steps on the way there.
(Tag-by-tag detail with examples lives in the DMARC record guide.)
rua= — where aggregate reports are sent. Without it, providers have nothing to send and you are enforcing a policy blind. This is the tag most commonly missing.
ruf= — forensic reports on individual failing messages. Most providers no longer send these, for privacy reasons, so its absence costs you very little.
sp= — a separate policy for subdomains. If you do not set it, subdomains inherit p=. Setting sp=reject while your main domain is still on none is a reasonable way to protect names you never send from.
pct= — the percentage of failing mail the policy applies to. pct=25 with p=quarantine quarantines a quarter of failures and leaves the rest alone. It exists to let you ramp up gradually.
adkim= and aspf= — how strictly the authenticated domain must match your From address. r (relaxed, the default) accepts a subdomain; s (strict) demands an exact match. Relaxed is right for almost everyone.
What your result means
No record found. Anyone can send mail as your domain and no provider has been told otherwise. This is the case worth fixing today, and publishing p=none with a rua costs nothing and changes no delivery.
A record with p=none. The common case, and the one most domains never move past. You are collecting evidence but blocking nothing — a spoofed message still lands. none is a starting point, not a destination.
A record with no rua. You have a policy and no visibility. If it is set to quarantine or reject, you are blocking mail without being able to see what you blocked — including your own invoices, if a vendor was never authorised.
Two DMARC records. A domain may publish exactly one. Two is not additive; receivers treat it as an error and apply no policy at all, which usually means your enforcement has silently stopped working.
p=reject with everything aligned. The goal. Worth re-checking after any change to how you send mail, because a new vendor that nobody authorised fails silently from here on.
What to do next
If you have no record, publish v=DMARC1; p=none; rua=mailto:you@yourdomain.com and leave it for a fortnight. Reports will arrive as XML, one file per provider per day.
If you are already on p=none, the work is not editing the record — it is reading those reports until you can name every service that sends as you. Then move to quarantine, then to reject — the policy guide covers each step’s risks. Skipping that step is how legitimate mail gets blocked, and it is why most domains stall at none for years.
The reports themselves are dense XML from dozens of senders, which is the part people give up on. How to read a DMARC report covers the format, and what DMARC is covers the mechanism underneath it. If SPF or DKIM is the piece failing, the SPF checker and DKIM checker go deeper on each.
Common questions
Does publishing DMARC affect my email delivery?
Not at p=none — it changes nothing about how mail is handled and only asks for reports. Delivery changes when you move to quarantine or reject, which is exactly why you read the reports first.
Do I need SPF and DKIM as well?
Yes. DMARC does not authenticate anything itself; it checks whether SPF or DKIM passed and matched your From domain. A DMARC record on a domain with neither will fail every message once you enforce it.
Why does my record pass here but mail still gets spoofed?
Almost always because the policy is p=none. The record is valid and the check passes, but you have not asked anyone to block anything. Valid and enforcing are different states.