Read a DMARC policy, then build the next one. Move from monitoring to reject one safe step at a time.
Example
Path to enforcement
Build the record
Publish this record
A TXT record. Receivers pick up a change as its TTL expires.
The record, tag by tag
Findings
Capabilities and processing
Enter a domain or paste a DMARC record. A domain is looked up at _dmarc.<domain> by our server; a pasted record is read in your browser.
Each tag is explained, problems are listed with fixes, and a builder edits policy, subdomain policy, percentage, report addresses, alignment and failure options. The rollout steps move the record from monitoring to quarantine at 25%, quarantine and reject. Every change is kept in a history you can revert one step at a time.
Example workflow
harbor-supply.example monitors with p=none. Choose Try enforcement, review the draft record, then copy it to publish at _dmarc.harbor-supply.example.
Limits and interpretation
The tool reads the policy, not the reports; it cannot tell whether legitimate mail already passes. Move to enforcement only after aggregate reports show your senders aligned. External report addresses need an authorization record at the receiving domain. The application does not persist tool inputs or results.
The lookup checks the exact _dmarc name. Parent-domain inheritance and external reporting authorization are not resolved; a missing exact record does not prove DMARC is absent.
Related tools
SPF Checker inspects authorized-sender records. DKIM Record Checker inspects signing keys. Email Header Analyzer reads reported message authentication results.