What's the difference between p= and sp=?

The "p" tag sets the policy for the exact domain, while the optional "sp" tag sets a separate policy for its subdomains. If sp is omitted, subdomains inherit the same policy as p.

Should I start with p=none?

Many security guides recommend starting with p=none while you collect aggregate reports (rua) and confirm all your legitimate sending sources pass SPF and DKIM. Once you're confident nothing legitimate is being flagged, you can move to quarantine and eventually reject for stronger protection.

Hostperl DNS Tools

DMARC Checker

Check a domain's DMARC record to see its policy, reporting addresses, percentage, and alignment mode at a glance.

DMARC builds on SPF and DKIM by telling receivers what to do when a message fails authentication, and where to send reports about it. Check your domain's current policy below.

Frequently asked questions

DMARC tells receiving mail servers what to do when a message fails SPF or DKIM checks — monitor only (none), send to spam (quarantine), or reject outright (reject). It also defines where aggregate and forensic reports about authentication failures should be sent.