Inspect _dmarc.<domain>. Reveals the policy (p), sub-domain policy (sp), pct, and aggregate/forensic reporting addresses. Pair with the SPF and DKIM checkers for a complete email-auth picture.
Enter a value above to run a lookup.
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails SPF and DKIM, and where to send aggregate reports. It’s the policy layer that turns SPF/DKIM into a real anti-spoofing system.
Start with p=none + rua=mailto:reports@yourdomain to collect 30 days of telemetry. Then move to p=quarantine pct=10 and ramp to p=reject pct=100. Sub-domain policy (sp=) controls whether children inherit; lock it down to reject any unused subdomains.
Plain SMTP forwarding rewrites the envelope sender, which breaks SPF. DKIM survives if the body isn’t mutated. DMARC requires either SPF or DKIM to align with the From: header, so DKIM-signing hard is the practical path forward.
rua= = aggregate XML reports (daily/weekly summaries). ruf= = forensic per-message reports, only honored by a few receivers. Most teams point rua at a managed reporting platform; ruf can be omitted.