Skip to content
SiteGuardiaSiteGuardia

Preferences

Check your DMARC record

DMARC tells receiving mail servers what to do when a message claiming to be from you fails your checks. This check reads the record you publish and the policy in it. What each receiver then does with a failing message is their decision, and it is not visible from a DNS lookup.

2 scans per site each day. No account. Nothing is exploited.

This check is part of the full reading. Entering an address runs all five categories.

What DMARC decides

SPF and DKIM let a receiving mail server check whether a message really came from you. DMARC is the record that tells it what to do when the answer is no, and where to send a report about it. Without DMARC, those checks can fail and the message is still delivered. With DMARC at reject, it is not.

Why this matters most to a small business

Invoice fraud starts with a message that appears to come from a supplier your customer already trusts. It needs no technical skill and no access to your systems. A DMARC record at reject is the single cheapest thing that makes your domain a poor choice for it.

How to roll it out without losing mail

Publish at p=none with a reporting address first. Read a month of reports and find every legitimate service that sends as you, including the ones nobody remembers signing up for. Then move to quarantine at a low percentage, raise it, and finally set reject. Going straight to reject is how a newsletter provider stops delivering on a Monday morning.

  • Start: v=DMARC1; p=none; rua=mailto:dmarc-reports@your-domain
  • Read the reports for a month, list every legitimate sender
  • Move to p=quarantine with pct=25, then raise
  • Finish at p=reject