DMARC Lookup & Generator

Start with p=none to monitor without enforcing. Analyze the aggregate reports (rua) for 2-4 weeks to identify all legitimate email sources. Fix any SPF/DKIM misconfigurations. Then move to p=quarantine; pct=10 (quarantine 10% of failing mail) and gradually increase pct. Finally, move to p=reject once you're confident all legitimate mail passes. This phased approach prevents accidentally blocking legitimate email.

Relaxed alignment (r) allows the authenticated domain to be a parent of the From domain. For example, SPF passes if mail.example.com aligns with example.com. This is the default and works for most setups including email forwarding. Strict alignment (s) requires an exact domain match — mail.example.com would NOT align with example.com. Only use strict if you have a specific security requirement.

Aggregate reports are daily XML files sent by receiving mail servers (Gmail, Yahoo, Microsoft, etc.) that summarize authentication results for your domain. Each report shows: the sending IP, volumes of email, SPF and DKIM pass/fail results, and the disposition applied. Analyzing these reports is essential for understanding your email ecosystem and identifying unauthorized senders. Free tools like DMARC Analyzer and Google Postmaster Tools can parse these XML reports into readable dashboards.

DMARC defines three policy levels via the p= tag:

p=none — Monitor-only mode. No action is taken on failing emails — they are delivered normally. You receive aggregate reports to see what's happening. Use this when first setting up DMARC.

p=quarantine — Failing emails are sent to the spam/junk folder rather than rejected outright. Good intermediate step before full enforcement.

p=reject — Failing emails are rejected outright by the receiving server and never delivered. The strongest protection against spoofing. Required for BIMI logo display.

rua (Aggregate reports) — Daily XML summary reports sent by receiving mail servers (Gmail, Yahoo, Microsoft) to your specified email address. They show volumes of email passing and failing authentication, sending IPs, and disposition applied. These are the most important reports for monitoring your email ecosystem.

ruf (Forensic reports) — Per-message failure reports sent immediately when an email fails DMARC. They contain full email headers (and sometimes body) of failing messages, which is useful for debugging but raises privacy concerns. Many providers (Apple, Yahoo) no longer send ruf reports. Treat ruf as optional supplementary data.

Always start with p=none (monitor only) with a rua= address to receive aggregate reports. A minimal starting record looks like:
v=DMARC1; p=none; rua=mailto:[email protected]

Run this for 2–4 weeks and analyze the reports to identify every source sending email as your domain. Ensure they all have valid SPF and DKIM. Only then move to p=quarantine (start at pct=10) and gradually increase. This phased approach prevents accidentally blocking legitimate email.

DMARC alignment requires that the domain authenticated by SPF or DKIM matches the domain in the visible From: header. This is what prevents display-name spoofing.

Relaxed alignment (adkim=r / aspf=r) — The organizational domain must match. mail.example.com aligns with example.com because they share the same organizational domain. This is the default and works for most setups.

Strict alignment (adkim=s / aspf=s) — The domains must match exactly. mail.example.com does not align with example.com. Use strict only if you have a specific security requirement.

Yes, DMARC with p=reject or p=quarantine can break traditional mailing lists. When a list server resends a message, it preserves the original From: header (your domain) but sends from its own IP — which fails SPF. Modern mailing list software handles this by rewriting the From: header to the list's own domain or using the ARC (Authenticated Received Chain) protocol. If you use mailing lists, check with the list provider for DMARC compatibility before enforcing a strict policy.

The pct= (percentage) tag controls what fraction of failing emails the DMARC policy is applied to. The default is pct=100 (all failing emails). Setting pct=10 means the quarantine or reject policy only applies to approximately 10% of failing messages. This allows a gradual rollout: start at p=quarantine; pct=10, watch for legitimate email being caught, increase to 25%, 50%, 75%, 100% over several weeks. Once you reach pct=100, you can remove the tag entirely.