Email security

DMARC record published

SPF, DMARC, DKIM, MTA-STS: protection against spoofed mail in your name.

Why it matters

DMARC is what makes SPF and DKIM enforceable. Without it, spoofed mail in your name reaches inboxes, and since 2024 Google and Yahoo require DMARC from bulk senders.

How to fix it

Moderate · a few hours

Publish a DMARC record in monitoring mode with a report address.
Review the reports for 2-4 weeks and fix any legitimate sender that fails.
Move to p=quarantine, then p=reject.

DNS TXT (step 1: monitor)

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

DNS TXT (goal: enforce)

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]"

Test this now, free: SPF, DMARC & DKIM checker - no sign-up.

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free