Bitelio
§ T-05  —  Tool← All tools

DMARC record
checker

Fetch a domain's DMARC record and see where it stands: the active policy, the reporting setup, and exactly what to change to reach full enforcement.

DMARC record lookup

Enter the domain without http:// or www.

§ 01DMARC explained

Three policies, one path.

Nobody starts at reject — you observe first, verify, then tighten the screws.

Step 01p=none

Monitor

The starting point. Nothing is blocked yet — add rua= to collect aggregate reports and map out every service sending as your domain.

Step 02p=quarantine

Quarantine

When the reports show your legitimate mail passing consistently, step up. Failures now land in junk folders, blunting most spoofing attempts.

Step 03p=reject

Reject

The destination. Receiving servers drop failing mail outright, and spoofing your domain stops working entirely.

Deliverability, handled end to end.

Guided SPF, DKIM, and DMARC configuration plus ongoing reputation monitoring — all part of the platform.

Start with BitelioWhat is DMARC?

Frequently asked questions

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) sits on top of SPF and DKIM and turns them into an enforceable policy. It instructs receiving servers how to treat mail that fails authentication — deliver and monitor (none), send to the spam folder (quarantine), or refuse it outright (reject) — and adds a reporting channel that shows you who is sending as your domain.

What is the difference between p=none, quarantine, and reject?

With p=none you are only observing: failures get reported, but mail still lands. p=quarantine pushes failing messages into the spam/junk folder, and p=reject refuses them at the door. The sensible rollout is staged — monitor at p=none, study the reports, then step up to quarantine and finally reject.

What are DMARC aggregate reports?

The rua= tag asks receiving servers to send XML summaries of how your domain's mail fared against SPF and DKIM. Those reports reveal every service sending on your behalf, expose configuration mistakes, and surface spoofing attempts. Raw XML is painful to read, so most teams run it through a DMARC reporting service that parses and visualises it.

Why do I need DMARC if I already have SPF and DKIM?

Because SPF and DKIM only authenticate — they never decide consequences, and neither one guards the From header your recipients actually see. DMARC supplies both pieces: it defines what happens on failure and demands alignment with the visible sender. Without it, even flawless SPF and DKIM leave the From header open to spoofing.

What is DMARC alignment?

Alignment means the domain that passed SPF or DKIM must correspond to the From header domain. In relaxed mode (r) a subdomain counts as a match; strict mode (s) demands identical domains. This alignment requirement is precisely what makes SPF and DKIM meaningful to the address users see.