Skip to content
Toolbox

DMARC Check

The DMARC check shows your domain's policy, subdomain rules and report recipients, and checks whether external recipients are allowed to receive reports.

DMARC tells receiving mail servers what to do with messages that pass neither SPF nor DKIM in alignment with the sender domain: deliver them, put them in spam or reject them. DMARC also defines where reports about such messages go. The DMARC-Check in the Mail category reads the record and explains every tag. It requires a license.

How to check

Enter the domain and click Prüfen (check). The app looks for a TXT record at _dmarc.<domain>. If there is none, it checks the organizational domain, so for shop.example.com it looks at _dmarc.example.com. You then see the note „Record von der Organisations-Domain …“ (record from the organizational domain), and for the subdomain sp applies if set, otherwise p.

The DMARC-Record table lists each tag with its value and meaning:

Tag Meaning
p policy of the domain: none, quarantine or reject
sp policy for subdomains
np policy for non-existent subdomains
pct share of messages the policy applies to (default 100)
rua recipients of aggregate reports
ruf recipients of failure reports
adkim, aspf DKIM and SPF alignment, r relaxed or s strict
fo when failure reports are generated
ri reporting interval in seconds

The policy

Policy Finding Meaning
p=none Warning monitoring only; forged mail isn’t rejected
p=quarantine OK forgeries land in spam
p=reject OK forgeries are rejected

The usual path: start with p=none and rua, analyze the reports for a few weeks until all legitimate senders (newsletter service, shop, CRM) pass SPF or DKIM, then raise the policy to quarantine and finally to reject.

Other findings

Finding (as shown in the app) What to do
Kein DMARC-Record No DMARC record. Create a TXT record at _dmarc.<domain>, for example v=DMARC1; p=none; rua=mailto:dmarc@<domain>.
2 DMARC-Records (or more) With multiple records, receivers apply no DMARC at all. Reduce to one.
Fehler im Record Error in the record, for example a missing p, an invalid value for sp, pct, adkim, aspf or fo, or the record doesn’t start with v=DMARC1.
„p“ sollte direkt nach „v“ stehen p should come right after v. Fix the order.
Unbekanntes Tag Unknown tag, ignored by receivers. Check for typos.
Subdomains mit sp=none ungeschützt Subdomains with sp=none are unprotected; attackers can forge any subdomain. Remove or raise sp.
Policy gilt nur für … % der Mails The policy only applies to part of the mail. Remove pct or set it to 100 once all legitimate sources authenticate.
Keine Sammelberichte (rua) Without rua you won’t learn who sends on behalf of your domain.

External report recipients

If reports go to an address under a different domain, for example a DMARC service provider, that domain must explicitly allow it. It does so by publishing a TXT record v=DMARC1 at

<your-domain>._report._dmarc.<recipient-domain>

The app checks this for every external recipient in rua and ruf:

  • Externer Empfänger … ist autorisiert (authorized): all good.
  • Externer Empfänger … nicht autorisiert (not authorized): senders discard the reports. The provider has to create the record. Many do this automatically once you add the domain to your account with them.
  • Autorisierung von … nicht prüfbar (not checkable): the query got no answer. Check again later.

See also