Reads and explains your DMARC policy, and tests report delivery.
DMARC tells receiving mail servers what to do with a message that claims to be from your domain but fails authentication, and sends you reports of who is using your name. Without it, anyone can send mail that looks like yours.
Enter a domain to see its record, what each tag means, whether the policy actually protects anything, and whether the addresses that should receive your reports will really get them.
Publish p=none with a rua address, and read the reports for a few weeks to find every service that sends as your domain. Fix SPF and DKIM for each, then move to quarantine at a small pct, raise it, and finally set reject.
If the rua address is at a different domain, that domain must publish a record at yourdomain._report._dmarc.theirdomain agreeing to receive them. Without it receivers drop the reports. The check tests this.
No. A subdomain uses the organisational domain's record unless it publishes its own. The sp tag sets a different policy for all subdomains.
Yes. Google and Yahoo have required it from bulk senders since 2024, and any domain can be impersonated whatever its size.