What should my first DMARC record be?

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain — monitoring only, with reporting enabled. Collect data for at least a few weeks before considering enforcement.

What does alignment mean?

The domain that passed SPF or DKIM must match the From: header domain. Relaxed alignment allows a subdomain of the same organisational domain; strict requires an exact match.

Will DMARC stop all spoofing of my brand?

No. It stops unauthenticated use of your exact domain in From:. Lookalike domains and display-name spoofing are outside its scope and need brand monitoring.

Why is legitimate mail failing DMARC?

Usually alignment: the message passes SPF or DKIM under a provider's domain rather than yours. Configure the provider to sign with your domain, or authorise it so the passing domain aligns.

TLS & Email🌐 YAS server-sideAPI availableadvanced

DMARC Inspector

Fetches and explains a domain's DMARC record: policy, alignment, pct, rua/ruf.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

DMARC Inspector — _dmarc.<domain>

Fetches the DMARC TXT record and validates policy, alignment and reporting tags.

What does this tool do?

Fetches and explains a domain's DMARC record: policy, alignment, pct, rua/ruf.

Why would I use it?

You want to know what your DMARC policy actually does.
You are moving from p=none to p=quarantine/reject.
You received a DMARC failure report.

Real-life example

Input

example.com

Output

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@example.com — Policy: reject

Each tag is explained in plain language.

Input → Process → Output → Next

Input: Enter a domain.
Process: YAS queries _dmarc.<domain> TXT and explains each tag.
Output: The record plus per-tag interpretation.
Next action: Raise the policy only after SPF/DKIM alignment is stable.

Common mistakes

Setting p=reject before SPF/DKIM is reliable (legit mail gets rejected).
Forgetting rua for report delivery.
Using pct=0 forever (no enforcement).

What the result means

The policy tag tells receivers what to do with failing mail.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/dmarc-inspector

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/dmarc-inspector" \
  -H "Content-Type: application/json" \
  -d '{"input":"example.com"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/dmarc-inspector", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "example.com"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/dmarc-inspector", json={"input":"example.com"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Domain, e.g. example.com

Success response

{ "result": { "found": true, "record": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com", "policy": "reject", "subdomainPolicy": null, "pct": 100, "adkim": "r", "aspf": "r", "rua": ["dmarc@example.com"], "valid": true, "issues": [] } }

Fetch and validate _dmarc.<domain> TXT: policy badge, alignment, pct, rua/ruf.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How DMARC Inspector works

DMARC ties SPF and DKIM to the domain a user actually sees. A TXT record at _dmarc.<domain> declares a policy (p=none, quarantine or reject), optional reporting addresses (rua for aggregate, ruf for forensic), a percentage rollout and alignment modes. A message passes DMARC when SPF or DKIM passes and the corresponding domain aligns with the From: header domain.

Alignment is the mechanism that gives DMARC its value. Relaxed alignment accepts an organisational-domain match (mail.example.com aligns with example.com); strict requires exact equality. Without alignment an attacker could pass SPF using their own domain while displaying yours in From:, which is exactly the gap DMARC closes and neither SPF nor DKIM closes alone.

When to use it: real-world scenarios

Starting a DMARC programme safely

Publish p=none with rua reporting, read aggregate reports for several weeks to inventory legitimate senders, then move to quarantine and reject in stages.

Finding senders you did not know about

Aggregate reports reveal every source sending as your domain — usually including a forgotten CRM, a monitoring system and a partner's mail server.

Qualifying for BIMI

Displaying a brand logo in supporting mail clients requires DMARC at quarantine or reject. There is no shortcut.

Investigating why legitimate mail is rejected

A sender that passes SPF but fails alignment is the classic cause: authenticated under the provider's domain rather than yours.

Pro tips

Never start at p=reject. You will reject your own mail from a system nobody remembered, and the first evidence will be a colleague's complaint.
Always set rua. A DMARC record without reporting gives you enforcement without visibility, which is how enforcement goes wrong.
Use pct= to ramp gradually — 25, then 50, then 100 — so problems surface on a fraction of mail rather than all of it.
Subdomains inherit the organisational policy unless sp= says otherwise. Set sp=reject on domains whose subdomains never send mail.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

DMARC protects the From: header domain only; display-name spoofing and lookalike domains are unaffected.
Forwarding and mailing lists break SPF alignment and can break DKIM if the list modifies the message; ARC exists to address this and is not universally deployed.
Aggregate reports are XML, delayed by up to a day, and impractical to read without tooling.
Forensic (ruf) reports are rarely sent by receivers due to privacy concerns.

Frequently asked questions

What should my first DMARC record be?: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain — monitoring only, with reporting enabled. Collect data for at least a few weeks before considering enforcement.
What does alignment mean?: The domain that passed SPF or DKIM must match the From: header domain. Relaxed alignment allows a subdomain of the same organisational domain; strict requires an exact match.
Will DMARC stop all spoofing of my brand?: No. It stops unauthenticated use of your exact domain in From:. Lookalike domains and display-name spoofing are outside its scope and need brand monitoring.
Why is legitimate mail failing DMARC?: Usually alignment: the message passes SPF or DKIM under a provider's domain rather than yours. Configure the provider to sign with your domain, or authorise it so the passing domain aligns.