Look up any domain's DMARC record and see, for free, whether it is protecting the domain: the raw record, whether the policy is none, quarantine or reject, and whether aggregate reporting is set up. No sign-up.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record published at _dmarc.yourdomain.com. It builds on SPF and DKIM: it ties them to the visible From address, tells receiving servers what to do with mail that fails authentication, and asks them to send you reports on everything claiming to be from your domain. Without DMARC, a spoofer can forge your From address even when SPF and DKIM are in place, because neither of those checks the address a person actually reads.
The p= tag is the heart of DMARC. Moving up this ladder is how a domain goes from spoofable to protected.
| Policy | What it does |
|---|---|
| p=none (monitor) | Take no action, just send reports. The safe first step: you see who is sending as your domain without risking legitimate mail. It provides no protection on its own. |
| p=quarantine | Send mail that fails authentication to the spam folder. Real protection, with a soft landing while you confirm every legitimate sender passes. |
| p=reject | Block mail that fails authentication outright. The end goal and the strongest protection against spoofing of your domain. |
A DMARC record is a set of tag=value pairs. These are the ones that matter in practice.
| Tag | What it means |
|---|---|
| p= | The policy for the domain: none, quarantine, or reject. Required. |
| sp= | A separate policy for subdomains. If omitted, subdomains inherit p=. |
| pct= | The percentage of failing mail the policy applies to (1-100). Useful for a gradual rollout; pct=100 is full enforcement. |
| rua= | Where to send aggregate (daily summary) reports, as mailto: addresses. This is how you see what is authenticating and what is not. |
| ruf= | Where to send forensic (per-failure) reports. Fewer providers send these, and they can contain message data, so many domains omit it. |
| adkim= / aspf= | How strictly DKIM and SPF alignment are enforced: r (relaxed, the default) or s (strict). |
Type any domain (like acme.com). The checker looks up the DMARC record at _dmarc.<domain> in public DNS.
See the raw record, whether your policy is none, quarantine or reject, and whether aggregate (rua) reporting is set up.
Use the reading to move from monitoring to enforcement: fix senders, then tighten the policy at your DNS host and re-check.
Yes, and it needs no sign-up. It reads your domain's public DNS at _dmarc.<domain>, parses the record, and explains your policy and reporting setup. Nothing to install, nothing to pay.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record published at _dmarc.yourdomain.com. It ties SPF and DKIM to the visible From address, tells receiving servers what to do with mail that fails (nothing, quarantine, or reject), and asks them to send you reports on all mail claiming to be from your domain. It is what turns SPF and DKIM from advisory checks into real anti-spoofing enforcement.
The p tag is your DMARC policy. p=none means monitor only: you get reports but failing mail is still delivered. p=quarantine sends failing mail to spam. p=reject blocks it outright. The recommended path is to start at none to gather reports, move to quarantine once your legitimate senders pass, then reach reject for full protection.
Yes. SPF and DKIM each authenticate part of a message, but neither checks the From address a person actually sees, and neither tells receivers what to do on failure. DMARC binds SPF and DKIM to the visible From domain and sets the policy. Without DMARC, a spoofer can still forge your From address even with SPF and DKIM in place.
rua is where DMARC aggregate reports are sent: a daily XML summary from each receiver of how much mail passed and failed authentication for your domain. Those reports are how you discover a legitimate sender you forgot to authorize before you move to quarantine or reject. A DMARC record with no rua works, but you are flying blind, so add one.
p=none is monitoring, not protection: it collects reports but takes no action, so anyone can still spoof your domain and the mail is delivered. It is the correct first step, not the destination. Once your reports show every legitimate sender passing, tighten to quarantine and then reject. A domain left at p=none indefinitely gets the reporting benefit but none of the anti-spoofing benefit.
For most organizations, a few weeks to a couple of months. You spend the first weeks at p=none reading aggregate reports and fixing or authorizing every legitimate sender, optionally use pct= to enforce on a slice of mail, then move to quarantine and finally reject once the reports are clean. Rushing to reject before your senders pass can send real mail to spam.
PeopleSearch.im finds the professionals you describe in plain English and their verified professional emails, so your outreach reaches a real inbox.
