What is DMARC? Spoofing policy + free DMARC checker
DMARC is the rulebook on top of SPF and DKIM: if a message fails authentication, should receivers quarantine it, reject it, or just watch? A free DMARC checker confirms _dmarc still publishes v=DMARC1 before you raise policy or chase BIMI logos.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS policy that tells receiving mail systems what to do when a message claiming to be from your domain fails SPF and/or DKIM alignment. It sits on top of those two checks: SPF lists allowed senders, DKIM seals the message, and DMARC decides whether a fail should be observed, quarantined, or rejected—and where aggregate reports (rua) should go.
The DNS record (_dmarc)
Publish a TXT at _dmarc.yourdomain that starts with v=DMARC1 and includes a p= policy (none, quarantine, or reject). Most teams also add rua=mailto:… so aggregate XML reports land somewhere someone reads. Optional tags like pct=, fo=, and rua/ruf tune rollout and forensics—start simple: one record, clear policy, one rua mailbox you control.
How to check DMARC (free DMARC checker)
1) Run the free DMARC checker on the bare domain. 2) Confirm a v=DMARC1 TXT exists at _dmarc—not a random TXT at the apex. 3) Read p=: none means observe-only; quarantine/reject means enforcement. 4) Confirm rua points at a mailbox or HTTPS endpoint you still own. 5) If you expect logos later, remember BIMI needs enforcement first. 6) After any zone edit, re-check; underscore hosts are easy to drop in panel rebuilds.
What CrowWake checks
We read TXT at _dmarc.yourdomain for v=DMARC1. Missing record = fail. A policy of p=none is allowed but flagged as warn—you are monitoring without blocking spoofed mail yet. The free DMARC checker uses the same public lookup with no login. CrowWake does not ingest rua XML reports in v1—just whether the policy pointer is still published and how soft it is. For the repeat “watch this hourly” job, see the dedicated DMARC monitoring guide.
DMARC vs DMARC monitoring
This guide is the definition and publish/triage job: what DMARC is, how _dmarc + p=/rua work, and how to check DMARC with a free DMARC checker. DMARC monitoring is the hourly rooster—catch a wiped _dmarc, a forever-p=none that never tightened, or a broken TXT after a zone copy. Both use the same free checker; CrowWake just repeats the pulse.
Why it matters
Phishers love sending as [email protected]. DMARC is how brands tell the world “if it is not really us, don’t trust it.” Bulk senders and mailbox providers increasingly expect a published policy. Agencies lose _dmarc during rebuilds and only notice when spoof complaints spike—or when marketing asks why BIMI never appeared because policy was still on p=none.
What “good enough” looks like
Start with p=none plus rua reporting while you inventory senders with SPF and DKIM. Move toward p=quarantine or p=reject once legitimate mail passes alignment. One _dmarc TXT—not competing rows. CrowWake’s job in v1 is health of the DNS record—not parsing XML reports.
Publish checklist (order matters)
1) Confirm SPF covers every real sender (free SPF checker). 2) Confirm DKIM selectors are live for those ESPs (free DKIM checker). 3) Publish _dmarc with v=DMARC1; p=none; rua=mailto:… 4) Read reports for a stretch, then tighten to quarantine/reject. 5) Re-check with the free DMARC checker, then add the domain so CrowWake crows if the record disappears or stays observe-only forever.
If CrowWake crows
No DMARC → publish a starter p=none with rua. Stuck on p=none forever → inventory SPF/DKIM senders, then plan quarantine/reject. Broken TXT syntax → fix quoting/spaces in DNS. After any fix, re-run the free DMARC checker, then confirm CrowWake goes green.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free DMARC / DMARC checker checker with no login.
Deep dive: DMARC monitoring — watch _dmarc so a silent wipe or forever-p=none crows early, with the same free DMARC checker.
The free DMARC checker lists the live _dmarc policy. Pair with email authentication monitoring, what is email authentication, SPF monitoring, DKIM monitoring, and BIMI — logos only after enforcement.