What is DMARC?

DMARC is a TXT record named _dmarc in your domain’s DNS that tells receiving servers what to do with mail that claims to come from your domain but fails the checks. A message fails DMARC when neither its SPF nor its DKIM signature matches the domain in the From address. DKIM is a cryptographic signature your mail service adds to every message, with the public key in your DNS; CheckNet does not check it, but your mail service shows its value in its own panel. For SPF, see the SPF guide.

Why it matters

Without DMARC, someone sending forged mail in your domain’s name, to phish your customers for example, is less likely to be stopped. Since 2024 Gmail and Yahoo require bulk senders to publish at least a DMARC record, even with p=none. The reports DMARC sends you also show which servers are sending mail in your domain’s name.

Step by step to rejecting forged mail

1. First set up SPF and DKIM for every service that sends mail for your domain; each service’s own documentation gives its DKIM value.
2. In your DNS panel, create a record of type TXT, name _dmarc, with a value like the first example below. With p=none nothing is rejected yet; you only receive reports.
3. Read the reports that arrive at the rua address for a few weeks. They are XML files; a DMARC report analysis service makes them easier to read. Fix every real sender that fails, with SPF or DKIM.
4. Once nearly all your real mail passes, change p=none to p=quarantine so failing mail goes to spam. Watch the reports for a few more weeks.
5. Finally move to p=reject, so forged mail is not delivered at all.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com

Common problems

• More than one record: if _dmarc holds two DMARC records, receivers apply neither. Merge them into one.
• The wrong name: some panels append your domain themselves; typing the full _dmarc.example.com can create the record under a doubled name. Type just _dmarc.
• Staying on p=none: this stage only monitors and stops no forged mail. Move on once the reports look clean.
• Reports to another domain: if the rua address is on a different domain, that domain must publish a record agreeing to receive the reports. DMARC report services set this up for you.
• Forwarded mail and mailing lists: forwarding usually breaks SPF but keeps the DKIM signature intact, which is why DKIM is essential before p=reject.

The sp tag sets a separate policy for subdomains; without it, subdomains follow p. The pct tag, which older guides use to apply the policy to a percentage of mail, was retired in the new standard (RFC 9989, 2026); step from none to quarantine to reject instead.

Check it with CheckNet

On CheckNet’s DNS page, the DMARC row shows one of three results: “DMARC is set”, which is fine; “DMARC only monitors (p=none)”, which means you are still at p=none; and “No DMARC”, a warning when the domain has an MX record. The record’s value is in the records table, next to _dmarc TXT.