Key points at a glance
- The DMARC record is a TXT record on _dmarc.<your domain> and starts with v=DMARC1.
- Start with p=none and a reporting address, then quarantine and reject follow.
- SPF and DKIM must be correct for every genuine sender beforehand.
Prerequisites
DMARC builds on SPF and DKIM. So first check whether your SPF record names every sender, and whether your mail provider and other services sign with DKIM. An email passes DMARC if SPF or DKIM passes and the domain matches the visible sender.
The structure of the record
The record sits as a TXT record on the name _dmarc in front of your domain, for example _dmarc.example.com. A safe starting point looks like this: “v=DMARC1; p=none; rua=mailto:dmarc@example.com”.
- v=DMARC1: identifier, always comes first.
- p=: policy for forgeries – none (observe only), quarantine (spam folder) or reject (reject).
- rua=: address recipients send daily aggregate reports to.
- sp=: separate policy for subdomains (optional).
- adkim= and aspf=: how exactly the domain must match (optional, default is relaxed).
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
Step by step to p=reject
Let p=none run for two to four weeks and read the reports: they show every server sending with your domain. Add any missing genuine senders to SPF and DKIM. Only once practically all genuine emails pass DMARC do you switch to quarantine and then to reject.
- p=noneCollect reports, nothing is blocked.
- p=quarantineForgeries land in the spam folder.
- p=rejectForgeries are rejected.
observereject
Don’t start straight with reject
Anyone who switches to reject right away without evaluation risks their own invoices or newsletters no longer arriving.
Common mistakes
- Record on the domain instead of on _dmarc: then no one finds it.
- Two DMARC records: then neither applies.
- Reporting address on a foreign domain without authorisation: recipients then send no reports.
- Staying on p=none for years: the reports show forgeries but don’t prevent them.
Frequently asked questions
Is there a DMARC generator?
You can write the record yourself following the example above. More important than the record is evaluating the reports before you switch to reject.
Where do the DMARC reports go?
To the address in the rua field. The reports are technical files; without evaluation they are hard to read.
Do I need DMARC for domains without email too?
Yes. For such domains, “v=DMARC1; p=reject;” together with the SPF record “v=spf1 -all” is enough.
How DomainRadar helps
DomainRadar gives you the right reporting address, evaluates the DMARC reports for you, and shows clearly which senders are still missing. As soon as it’s safe, DomainRadar tells you when to switch to quarantine and reject.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.