About DMARC Records
What is a DMARC record?
DMARC is a DNS record telling receiving mail servers what to do with email claiming to come from your domain that fails authentication: let it through, quarantine it, or reject it outright.
It builds on SPF and DKIM rather than replacing them. Those establish whether a message is legitimate; DMARC decides the consequence when it is not, and reports back on what receivers are seeing.
That reporting is the part people underuse. A DMARC record in monitoring mode tells you who is sending mail as your domain, which is frequently more services than anyone expected and occasionally someone you did not authorise.
Does DMARC still matter in 2026?
It has moved from best practice to requirement. Major providers now demand authentication for bulk senders, and mail from domains without a policy is increasingly filtered before anyone sees it.
Without DMARC, anyone can send email appearing to come from your domain. That is a direct route to your customers being phished in your name, and to your domain acquiring a reputation you did not earn.
The policy levels matter as much as the record. A record set to take no action is still a record, and it protects nothing until it is enforced.
DMARC best practices
- Set SPF and DKIM up first; DMARC depends on both being correct.
- Start in monitoring mode and read the reports before enforcing anything.
- Move to quarantine, then reject, once legitimate senders are all passing.
- Publish exactly one DMARC record. Duplicates invalidate the policy entirely.
- Publish a policy even for domains that never send email, so they cannot be spoofed.
- Keep reading the reports after enforcing; new sending services appear without warning.
What this tool checks
The DMARC record tool queries DNS and reports whether a record exists, is missing, or is duplicated.
Duplicates are reported as a failure because more than one record causes the policy to be ignored entirely, which is worse than having none: it looks configured while protecting nothing.
Where to go next
DMARC only works when the records beneath it do. Confirm your
SPF record is present and unique, review the
DNS configuration all three live in, and check whether your site is publishing
email addresses in plain text.