Free tools · Email domain setup
DMARC Policy of Reject: Meaning and Rollout
A DMARC policy of reject asks receiving servers to reject mail that fails DMARC. That can include legitimate business mail when a sender is misconfigured. Review real sources and alignment before increasing enforcement.
Real public DNS lookup. No signup, mailbox connection or API key needed.
Check your published DMARC record
Enter your own public domain. The illustrated examples below are not preloaded and no lookup runs until you submit.
Look up your public DMARC record.
Enter your domain to see the published record and any issues found. Results appear here after a real DNS lookup.
DMARC record generator
Create a TXT record from the settings you choose. This builder runs in your browser and produces text for you to review. It does not update DNS.
Your TXT record
Add the settings you intend to publish, then generate the text. Compare it with your existing record before making changes with your DNS provider.
What to do next
1. Read the current policy
Use the checker to inspect the record for your exact From domain. Read policy and subdomain findings rather than assuming the root domain's visible record answers every case.
2. Identify legitimate failures
Review aggregate reports and received messages from all your sending services. Separate a failed authentication check from a successful but unaligned SPF or DKIM result.
3. Fix each authorised service
Use the provider's supported custom-domain authentication setup. Keep a record of which services were tested and which are still unresolved.
4. Plan and monitor enforcement
Have the responsible administrator choose the rollout and recovery plan. Review the new public policy and reports after any change. The builder remains at its monitoring default until you deliberately choose another policy.
An enforcement record to understand
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
This fictional value illustrates the reject tag. It is not a recommendation to replace your policy now. The recipient's server makes the final handling decision; publishing reject does not place mail in the Inbox.
One aligned pass can satisfy DMARC
A message can pass DMARC through aligned DKIM even when its SPF result fails, or through aligned SPF when DKIM fails. The domains used for each mechanism matter.
Keep monitoring after a change
New applications, provider migrations and forwarding paths can change authentication behavior. A clean DNS result today does not inventory those future sending sources.
Questions
Does reject block every forged message?
It is a published handling request for DMARC failures. Receivers apply their own policies, and DMARC does not authenticate the truth of a message's content or stop lookalike domains.
Can this checker tell me enforcement is safe?
No. It reviews DNS policy syntax and settings. Deciding readiness needs your sender inventory, alignment tests and report evidence.
Should I copy a pct= rollout example?
RFC 9989 removed the historic pct= percentage tag. Its t= testing flag has different behavior. Older receivers and provider guides can still use the previous rules; review current documentation rather than treating an old percentage as a dependable enforcement safeguard.
Checking sends your public domain to AskQuokka. Record generation and copying run in this tab. No DNS settings are changed and no email is sent. Domain inputs and lookup results are not included in tool analytics.
Official references
References checked 23 October 2026. Use your provider's current domain-specific values.
More setup and troubleshooting guides
Free DMARC Record Generator and Setup Guide
Generate DMARC TXT record text from your domain, policy and reporting address, then check public DNS. No account, API key or DNS access needed.
How to Read DMARC Aggregate Reports
Understand DMARC report source IPs, counts, alignment and disposition using a fictional example. Check the policy that requests your reports.