Why DMARC needs monitoring, not just a record
Publishing a DMARC record takes five minutes. Knowing what it does takes weeks of reading reports. A record such as v=DMARC1; p=none; rua=mailto:[email protected] asks every receiver to send you a daily XML file listing the IPs that sent mail with your domain in the From header, how many messages each sent, and whether SPF and DKIM passed and aligned.
Those files are where you find the CRM nobody told IT about, the invoicing tool that signs with its own domain, or a stranger spoofing your brand. Without someone reading them, a DMARC record at p=none protects nothing, and moving to p=reject blindly can block your own invoices. A DMARC monitoring service does that reading for you, every day.
What the three DMARC policies mean
Google and Yahoo have required a DMARC record from bulk senders since February 2024, and p=none is enough to meet that rule. Microsoft applies a similar requirement to high volume senders to Outlook.com since May 2025. The policy you choose beyond that is about protecting your brand, and reports are how you get there safely.
| Policy | What receivers do with failing mail | When to use it |
|---|---|---|
| p=none | Deliver as usual, just report | First weeks, while you find every legitimate sender |
| p=quarantine | Send to spam or junk | Once all known senders pass and align |
| p=reject | Refuse the message | Full protection against spoofing of your domain |
How DMARC monitoring works here
If you want to see how one report looks inside, our DMARC report analyzer page walks through the XML fields and how we read them.
-
1
Add your domain. We read your current DMARC record and flag problems such as a missing
ruatag, a syntax error, or a policy that does not apply to subdomains. -
2
Add your workspace reporting address to the
ruatag, next to any address you already use. Reports keep going to your own mailbox too. - 3 Receivers start sending reports within a day or two. We parse each XML file and group rows by sending source.
- 4 The dashboard shows each source (your ESP, your CRM, your help desk, unknown IPs) with volume, SPF and DKIM results, and alignment.
-
5
You fix the failing sources, then move from
p=nonetoquarantineandrejectwith data in hand.
Run a free check on your own domain or IP, then keep it monitored.
Check NowSender source discovery
Raw reports list IP addresses. A list of 40 IPs tells you little. On the Business plan and above, sender source discovery maps those IPs to the services behind them, so the dashboard reads "Google Workspace, 12,400 messages, aligned" or "unknown IP in a residential range, 300 messages, failing" instead of rows of numbers.
That is usually the moment a DMARC project moves. Most teams find one or two tools sending without DKIM on their own domain, fix them in an afternoon, and are ready for a stricter policy a few weeks later.
Alerts for DMARC and authentication changes
Alerts go to email and Slack on every plan, and to Teams and webhooks from Business up. You can also check the records themselves any time with our free DMARC checker.
- Your DMARC record disappears or changes, often after a DNS migration or a registrar move.
- A known sender stops passing DKIM, for example after a key rotation at your ESP.
- A new source starts sending as your domain in volume.
- Your SPF record goes over 10 DNS lookups or 2 void lookups and starts returning permerror.
DMARC reporting you can share
DMARC projects usually involve more than one team. IT owns DNS, marketing owns the ESP, and finance owns the billing tool that sends invoices. A dashboard that names each source by service and shows its pass rate over time gives all three the same picture, without anyone opening an XML file.
Business plans export the data as CSV and send a weekly digest. On Agency, the same DMARC reporting goes into white label PDF reports and client links, so an agency can show a client exactly which sources were fixed and when the domain reached p=reject. History is kept for 90 days on Starter, one year on Business, two years on Agency and three years on Scale.
DMARC reporting volume per plan
Plans count the messages described in the reports you receive each month: 50,000 on Starter, 1,000,000 on Business, 5,000,000 on Agency and 25,000,000 on Scale. A company that sends a few thousand emails a day fits on Starter. A busy newsletter or ecommerce brand belongs on Business. Every plan also includes blacklist monitoring and SPF, DKIM, MX, PTR and BIMI checks, so DMARC sits next to the rest of your email deliverability monitoring.
Frequently asked questions
What is DMARC monitoring?
DMARC monitoring is the ongoing collection and analysis of the aggregate reports receivers send for your domain. It shows which services send as you, whether they pass SPF and DKIM with alignment, and alerts you when something breaks.
How long should I stay at p=none?
Usually two to six weeks, long enough to see every legitimate sender in your reports, including monthly ones like billing tools. Move to quarantine once all known sources pass and align, then to reject.
Do I need a DMARC monitoring tool if I send little email?
If your domain is used for invoices, sign-ins or sales, yes. Spoofing does not depend on how much you send, and reports are the only way to see it.
Will adding your rua address stop reports to my own mailbox?
No. The rua tag accepts several addresses separated by commas, so you can keep your own address and add ours.
What is DMARC alignment?
Alignment means the domain that passed SPF or DKIM matches the domain in the visible From header. DMARC passes only when at least one of them passes and aligns.