See how a domain’s email authentication looks to Gmail, Outlook and every other receiver, with a belt grade and the exact fixes to make.
DMARC is a DNS record that tells mailbox providers what to do with mail that claims to be from your domain but fails authentication: deliver it (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It also asks them to send you daily reports about who is sending as you.
SPF lists the servers allowed to send mail for your domain. Receivers check the sending server against that list. Each include: of a service like Google or SendGrid costs DNS lookups, and the whole record may use at most 10.
DKIM signs each message with a private key; the public key sits in DNS under a selector such as google._domainkey. A valid signature from your own domain proves the message is really yours and wasn’t changed.
White belt: DMARC at p=none, watching and learning. Orange belt: p=quarantine, spoofed mail goes to spam. Black belt: p=reject, spoofed mail is refused outright. The goal is black belt with every legitimate sender passing.
Every check is scored out of 100. The belt comes from the DMARC policy alone: no belt without a DMARC record, White belt at p=none, Orange belt at p=quarantine and Black belt at p=reject.
| p=reject | 34–40 (40 at pct=100) |
|---|---|
| p=quarantine | 26–32 (32 at pct=100) |
| p=none | 15 |
| No DMARC record | 0 |
| Ends in -all | 30 |
|---|---|
| Ends in ~all | 27 |
| No “all” mechanism | 18 |
| Ends in ?all | 15 |
| Ends in +all | 5 |
| Over 10 DNS lookups | 8 at most |
| Key found | 25 |
|---|---|
| Key under 2048 bits | −5 each |
| No key on the selectors checked | 8 |
| MTA-STS | 3 |
|---|---|
| TLS reporting (TLS-RPT) | 2 |
Without DMARC, anyone can send mail that claims to be from your domain and receivers have no instructions for it. Start with p=none and a report address so you can see who sends as you. DMARC Dojo publishes the record and a private report inbox for you.
p=none only monitors: spoofed mail is still delivered. Move to p=quarantine, then p=reject, once your reports show every legitimate sender passing. DMARC Dojo reads the reports and tells you when each step is safe.
Each include:, a, mx and redirect costs a DNS lookup, and SPF allows 10. Past that, receivers return a permerror and SPF fails for all your mail. Remove services you no longer use or replace includes with ip4/ip6 ranges. DMARC Dojo hosts your SPF and blocks changes that would go over the limit.
A domain may have only one v=spf1 record. Two or more is an SPF error, so receivers treat SPF as failed. Merge every mechanism into a single record; DMARC Dojo does this automatically when it takes over SPF.
Services like SendGrid, Mailchimp or Amazon SES sign with their own domain by default, which doesn’t count for DMARC. Turn on custom-domain DKIM in each service and publish the CNAMEs or keys it gives you. The Sources view in DMARC Dojo shows exactly which services still need it.
A strict main policy with sp=none still lets attackers spoof any subdomain, such as billing.yourdomain.com. Remove sp= so subdomains inherit your policy, or set it to quarantine or reject. DMARC Dojo flags this in every domain report.
The SPF standard (RFC 7208) caps the DNS lookups a receiver will make while evaluating your record at 10, to stop SPF being used to flood DNS. Every include:, a, mx, ptr and exists counts, including lookups inside the services you include. Go over and SPF returns a permanent error, which counts as a fail for DMARC.
DNS can’t list the DKIM keys a domain has. You have to ask for each selector by name. The checker tries the selectors that Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES and other common senders use. If yours is different, add it in the selector field.
Yes. It only reads public DNS records, the same ones every mail server on the internet can see. Nothing is changed and nothing about the domain is stored.
Start at p=none and read the aggregate reports until every service that sends as your domain passes SPF or DKIM with alignment. Then move to p=quarantine at a low pct, raise it to 100, and finish at p=reject. DMARC Dojo reads the reports and tells you when each step is safe.