Read your DMARC policy + pct% and flag weak none vs strict reject.
Pull the DMARC record at _dmarc.yourdomain.com, parse the policy (none / quarantine / reject) and the percentage applied. DMARC tells receivers what to do with mail that fails SPF + DKIM alignment — without it, you cede that decision to whoever spoofs you.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is the policy layer that sits on top of SPF and DKIM. On its own, a passing SPF or DKIM check doesn't guarantee the visible From: address belongs to you — DMARC adds the missing piece by requiring that an authenticated identifier aligns with the From: domain. The record, published at _dmarc.yourdomain.com, then tells receivers exactly what to do when that alignment fails: nothing (p=none), quarantine to spam (p=quarantine), or outright reject (p=reject).
DMARC is a lifecycle, not a one-time toggle. You start at p=none with reporting turned on (rua=), which changes nothing about delivery but streams you aggregate reports showing every source sending as your domain — legitimate and not. You use those reports to find and authenticate the legitimate sources, then ramp the policy: none → quarantine → reject, often using the pct tag to roll out enforcement to a fraction of traffic first. The end state, p=reject at 100%, is what stops spoofers cold and is increasingly a hard requirement — Google and Yahoo now mandate at least p=none for bulk senders.
This checker reads your live DMARC record, reports whether it's present and valid, and surfaces the policy and percentage so you can see at a glance where you sit on that ramp. A p=none record is a starting line, not a finish line: it offers visibility but zero protection. Re-check it whenever you change senders, and treat anything still sitting at none after your sources are authenticated as unfinished work.
Nothing to delivery — it's monitor-only. p=none lets you collect aggregate reports (via the rua tag) showing who sends as your domain, without any enforcement. It's the safe first step, but it offers no protection against spoofing until you ramp to quarantine or reject.
quarantine tells receivers to treat failing mail as suspicious (typically route to spam); reject tells them to refuse it outright at SMTP time. reject is the goal state — it's what stops spoofers from spoofing you at all.
pct controls what fraction of failing mail the policy applies to — pct=25 means only a quarter of failing messages get quarantined or rejected, the rest fall back to the next-weaker action. It's a rollout safety valve; you lower the risk while ramping, then remove it (defaulting to 100%) once you're confident.
DMARC requires alignment, not just a pass. SPF authenticates the envelope-from domain, which often differs from your visible From: domain when an ESP sends on your behalf — so SPF passes but doesn't align. DKIM alignment usually solves this; check that your ESP signs with your domain, not theirs.
For bulk senders, yes — both now require at least a published DMARC record (p=none is the minimum) along with SPF and DKIM. Many security-conscious receivers go further and downrank domains still sitting at none.
Stay at p=none with reporting until your aggregate reports show every legitimate source authenticated and aligned. Then step to quarantine (optionally with a low pct), watch the reports, raise pct to 100%, and finally move to reject. The DMARC generator scaffolds each stage.
SieveGuard's Domain Health add-on monitors your DMARC policy on every domain you onboard, flags any drift back toward p=none, and shows enforcement status next to SPF and DKIM so you always know where you sit on the road to reject.