DMARC Check — Your Policy, and Whether It Is Doing Anything
DMARC ties SPF and DKIM together. It tells receiving servers what to do when a message claiming to be from your domain passes neither, and where to send reports about it. This check parses the record and reports the policy in force, how alignment is evaluated, whether subdomains inherit it, and what percentage of mail the policy applies to.
Why run it
Because most DMARC records do nothing. The overwhelming majority of domains publish a policy of none, which requests reports and instructs receivers to take no action — a perfectly reasonable first step that was meant to be temporary and became permanent. It looks like protection on a compliance checklist and provides none against spoofing. Reading the actual policy is how you find out which situation you are in, along with the percentage tag that can quietly limit enforcement to a fraction of mail.
Why automate it
Moving from none to quarantine to reject is a staged process that takes weeks and is easy to abandon halfway, and there is a particular failure worth catching: a policy that gets rolled back to none during an unrelated incident and never restored. Watching the record continuously confirms your enforcement level is still what you decided it should be. It also catches the subdomain policy tag being added or removed, which silently changes whether spoofing protection covers the subdomains attackers actually target.
What it gives you
Clarity about whether your anti-spoofing policy is enforcing or merely observing — a distinction that is invisible on a checklist and decisive in practice. Monitored, it stops a hard-won enforcement policy from quietly reverting.