Key points at a glance
- DMARC determines what happens to emails that forge your domain: nothing, the spam folder, or rejection.
- Only the p=reject level truly protects your customers and suppliers from forged emails sent in your name.
- The daily reports show who is sending in your name – provided someone actually reviews them.
DMARC in one sentence
DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a DNS record that specifies what a receiving mail server should do with emails that claim to come from your domain but fail the SPF and DKIM checks – and where it should send you reports about this.
How DMARC works
DMARC builds on two older mechanisms: SPF checks whether the sending server is allowed to send for your domain; DKIM checks a digital signature on the email. DMARC adds the decisive point: the verified domain must match the visible sender address (“alignment”). Only this makes the protection work where people actually look – at the sender shown in the mailbox.
- An email passes DMARC if SPF or DKIM passes and the respective domain matches the sender address.
- If it fails, the recipient applies your policy.
- Every day, large mailbox providers send you aggregate reports (XML) about who has sent in your name.
The three levels: none, quarantine, reject
The policy is set in the p= field of the record. A typical starting point looks like this: _dmarc.example.com TXT “v=DMARC1; p=none; rua=mailto:dmarc@example.com”.
- p=none: monitor only. Nothing is blocked, but you receive reports.
- p=quarantine: emails that fail land in the spam folder.
- p=reject: emails that fail are rejected. Only this level truly protects your domain against forgeries.
- p=noneMonitor only, nothing is blocked
- p=quarantineForgeries land in the spam folder
- p=rejectForgeries are rejected
No protectionFull protection
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
Why DMARC is essential for SMEs today
Since 2024, Google and Yahoo have required senders of larger volumes to have a DMARC record, and Microsoft has done the same for Outlook since 2025. Even those sending little benefit: DMARC reduces the risk of your emails landing in spam, and fraudsters can no longer misuse your domain unchecked.
Good to know
DMARC is a single DNS record with no licence costs. You start with p=none, and not a single email gets blocked.
Common pitfalls
- The record is set to p=none and stays there for years – providing no real protection.
- Nobody reads the reports because they arrive as XML files.
- Services such as newsletter tools, CRM or accounting software send in the domain’s name without SPF or DKIM set up, and get blocked once p=reject is active.
p=none provides no protection
With p=none you only see forgeries in the reports – they are still delivered. Plan the path to p=reject from the start.
How DomainRadar helps
DomainRadar receives your DMARC reports and translates them into a clear overview: which services send in your name, which are set up correctly and where forgeries appear. A wizard guides you step by step from p=none to p=reject.
The “Rejected spoofing” figure shows each month how many emails that failed DMARC the recipients rejected or quarantined according to their aggregate reports. If your domain is still on p=none, it shows instead how many spoofed emails were delivered.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.