dns.rehab by Marketstead

DMARC check

marketstead.com

DMARC for marketstead.com publishes p=reject: rejection of alignment-failing mail is requested.

DMARC tells receivers what to do with email that pretends to be from you, and asks them to send you reports. The table explains each part of the record.

  • 1 OK

Checked Took 0.1 s

DMARC record
v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected]; fo=1:d:s

The DMARC record at _dmarc.marketstead.com

The DMARC record at _dmarc.marketstead.com
Tag Value What it means
v DMARC1 Version — always DMARC1.
p reject Requested policy for alignment-failing mail: none (no DMARC-specific handling), quarantine (treat as suspicious) or reject (refuse). Receiver local policy decides final handling.
aspf s SPF alignment: r (relaxed) or s (strict).
adkim s DKIM alignment: r (relaxed, subdomains count) or s (strict, exact match).
rua mailto:[email protected],mailto:[email protected] Where receivers send daily summary reports.
ruf mailto:[email protected] Where receivers send copies of individual failures (few providers send these).
fo 1:d:s When to send failure reports (0, 1, d, s).

Tests

  1. OK

    DMARC policy

    DMARC for marketstead.com publishes p=reject: rejection of alignment-failing mail is requested. Final handling remains the receiver’s local policy; mail outside a legacy sample is not guaranteed delivery (RFC 9989 §5.4; RFC 7489 §6.6.4). Aggregate reports flow to mailto:[email protected],mailto:[email protected] — that is how you see who sends as your domain.

    More info about “DMARC policy”

    DMARC asks receivers how to handle mail that fails authentication aligned with the visible From: domain: p=none requests no DMARC-specific handling, p=quarantine requests suspicious treatment, and p=reject requests rejection. An aligned SPF or DKIM pass is enough to pass DMARC; unrelated lookalike domains are not protected by your policy. Final delivery is always the receiver’s local policy (RFC 9989 §5.4), not a guarantee made by the DNS record. Use aggregate reports to check legitimate mail before strengthening the requested policy. When a domain has no record, discovery can inherit its organization’s policy using at most eight DNS requests (RFC 7489 §6.6.3; RFC 9989 §§4.10–4.10.2). An inherited policy can set separate handling for subdomains (sp) and names that do not exist (np). A reporting address (rua) is optional under RFC 7489 §7.1; leaving it out does not weaken the requested handling.

How we got this answer

Every question we asked, in order, with how long each server took to reply.

  1. recursive resolver — asked _dmarc.marketstead.com SOA · 16 ms
    The zone holding _dmarc.marketstead.com is marketstead.com.
  2. todd.ns.cloudflare.com (108.162.193.146) — asked _dmarc.marketstead.com TXT · 13 ms
    1 TXT record returned (authoritative).

Check something else

Type a domain for the full DNS check, or a command like mx:example.com, dkim:example.com:google or blacklist:203.0.113.7.

Rather not deal with this yourself?

dns.rehab is made by Marketstead. We run DNS, email and the rest of the back office for small businesses — farms, shops, studios, restaurants — and we read reports like this one for a living.

Get help with marketstead.com →

Email me this result

We send it once, with the link. No newsletter, no follow-ups.