Skip to content
DMARC Done
Fix my DMARC
Free checkHow it worksPricingGuidesBlogLog in

How it works

From p=none to p=reject, with data at every step

DMARC enforcement goes wrong when someone flips the policy before knowing who sends email for the domain. We do it in the opposite order.

  1. Day 0

    You order and publish one record

    After checkout you land on your dashboard with one DMARC record to add. It keeps your current behaviour (p=none) and sends the daily reports to your private DMARC Done address. We check DNS automatically and tell you when it is live.

    AddType TXTHost / Name _dmarc
    v=DMARC1; p=none; rua=mailto:r7k2m9x4qz@dmarcdone.com; fo=1

  2. Days 1 to 14

    We find everyone who sends as you

    Google, Microsoft, Yahoo and other receivers send aggregate reports every day. We turn them into a list of sending services: your mailbox provider, newsletter tool, CRM, invoicing, website forms. You mark each one as yours or not yours, and we tell you exactly what each real sender needs (usually DKIM turned on or one SPF include).

  3. Day 14 or later

    Quarantine

    The move to quarantine unlocks only when every sender you marked as yours passes on at least 98% of its mail over the last 7 days, after at least 14 days of watching and reports on at least 5 different days. Fakes now land in spam instead of the inbox.

    AddType TXTHost / Name _dmarc
    v=DMARC1; p=quarantine; rua=mailto:r7k2m9x4qz@dmarcdone.com; fo=1

  4. Day 21 or later

    Reject

    After at least 7 days at quarantine, and with under 1% of your real mail quarantined, we give you the final record. Receivers now block email that pretends to be you.

    AddType TXTHost / Name _dmarc
    v=DMARC1; p=reject; rua=mailto:r7k2m9x4qz@dmarcdone.com; fo=1

  5. Until day 60

    Watch, alerts and proof

    We re-check your DNS every day and read every report. If a real sender starts failing, or someone removes the record, you get an email the same day. You also get a proof page showing your domain at p=reject, handy for insurers, auditors and customers.

Safety rules

The rules we do not bend

They are the reason the guarantee is affordable for us: when the data says wait, we wait.

  • Stage changes follow what is live in your DNS, verified by lookup, never what anyone says.
  • Nothing moves forward while a sender you marked as yours is failing.
  • Unknown senders above 2% of your volume must be reviewed before quarantine.
  • Low-volume domains (under 50 messages in 14 days) wait at least 21 days so the data is meaningful.
  • You make every DNS change yourself. We never need your passwords.

What you need

Access to your DNS settings (or the person who has it) and about 10 minutes per step. Usually 3 to 4 short changes in total.

What we never need

Passwords, admin access, mailbox access or a call. Everything happens through your dashboard and email.

After day 60

Your records keep protecting you. We tell you how to point reports to your own address or a free reader, so nothing depends on us.

Start with the free check

Free. No signup. We do not store the domains you check.