What DMARC is
DMARC is a short text record on your domain, at _dmarc.yourdomain.com. It tells inbox providers two things: what to do with email that claims to be from you but fails the SPF and DKIM checks, and where to send reports about the email sent using your domain.
Google, Yahoo and Microsoft now expect businesses that send email to have one. Without it, more of your mail is treated with suspicion, and anyone can send email that looks like it came from you.
p=none vs quarantine vs reject
| Policy | What happens to fakes |
|---|---|
p=none | Delivered as normal. You just get reports. A starting point, not protection. |
p=quarantine | Sent to spam or junk. |
p=reject | Turned away. The strongest protection. |
Common errors the checker finds
- No record at all.
- Two DMARC records (receivers then ignore both).
- A missing
mailto:in the report address. - The record at the wrong place in DNS.
- A policy stuck on
p=nonefor months.
Each one comes with the exact fix. There's more detail in Fix your DMARC, step by step.
Moving to p=reject safely
Before you tighten your policy, make sure every service that sends as you passes the checks, or their email will be blocked too. Move in stages, using pct= to apply the policy to a share of failing mail first. Our p=reject guide sets out the stages and timings.
Don't have a record yet?
Use the DMARC record generator. Answer three questions and paste the result into your DNS host.
Keep it fixed
Settings drift. A new mailing tool, a DNS move or an expired key can quietly undo the fix. Harbour reads the daily reports that inbox providers send about your domain and tells you in plain English when something breaks.
Start monitoring