IT Toolbox
Guide

How to check a DMARC record

Control the presence and policy of a field.

TopicIT Networking →
⌚ About 2 min read
View my favorites
DNS & Email Intermediate. 5 min

Control the presence and policy of a field.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Build the name DMARC

    Add _dmarc. in front of the domain.

  2. 2

    Query the TXT record

    Use Resolve-DnsName with TXT type.

  3. 3

    Check version

    L, registration must start with v=DMARC1.

  4. 4

    Read the policy

    p=none observed, p=quarantine requested quarantine, p=reject requested rejection according to the DMARC evaluation.

Commands utiles

Resolve-Dns(1) _dmarc.example.fr -Type TXT

À retenir

  • Start carefully with a compliance policy if you do not yet master all sources of send.
  • DMARC depends on SPF and/or DDIM alignment.
← All les guides
Technical deep dive

DMARC: alignment matters as much as SPF or DKIM

Technical checkpoints

  • DMARC passes when aligned SPF OR aligned DKIM passes; SPF pass on a non-aligned domain is not enough.
  • p=none collects reports without requesting enforcement; quarantine and reject should follow real source analysis.
  • pct supports gradual enforcement, while sp can define a separate subdomain policy.

Progressive rollout

Start in monitoring

v=DMARC1; p=none; rua=mailto:dmarc@example.com
... then p=quarantine / p=reject

Topic-specific pitfalls

  • Jumping directly to reject without analyzing SaaS and indirect senders creates false rejects.
  • Aggregate reports describe volumes and domains; they do not replace headers from a specific message.

How to validate

  • Main legitimate sources are aligned and visible in rua reports.
  • A real message shows dmarc=pass with the expected organizational From domain.
♡ 0