From blind spot to enforced policy

Run the free lookup to see what SPF and DMARC records are actually published right now. Most domains turn up with neither — that gap is invisible until you look for it.

SPF, DKIM, and DMARC each verify something different about a message, and DMARC is what ties them together into a policy. The guide covers what each one actually does, in plain language.

Add a DMARC record with p=none and an rua= address. This enforces nothing — it just tells mailbox providers where to send aggregate reports, so every source sending mail as your domain starts showing up.

Aggregate reports arrive as XML, not a dashboard. Until the monitoring tool here can parse them for you, reading them directly (or with another report analyzer) works in the meantime — the goal is a complete list of legitimate senders, all passing.

Once reports are clean, move from p=none to p=quarantine and eventually p=reject — in stages, watching reports at each step so legitimate mail never gets silently blocked.