Simulate a message
How it works
Find the policy
The record is fetched from _dmarc under the From domain; if there is none, the organisational domain's record applies and its sp= tag governs, exactly as receivers do it. Or paste a record to test one that is not published yet.
Test alignment
SPF aligns if the envelope domain matches the From domain; DKIM aligns if d= matches. Relaxed mode accepts the same organisational domain, strict needs an exact match, per adkim and aspf.
Reach a verdict
DMARC passes if at least one mechanism both passed and aligned. Otherwise the policy applies — reduced by pct sampling, which downgrades reject to quarantine and quarantine to none for the unsampled share.
Compare policies
The same message is shown under none, quarantine and reject so you can see what tightening the record would do before you do it.
How a receiver actually evaluates DMARC
The receiver takes the domain in the From header — the one the human sees — and looks up _dmarc there. If nothing is published, it looks at the organisational domain instead and uses the sp= tag if present, otherwise p=. Then it asks two questions. Did SPF pass, and is the envelope (Return-Path) domain aligned with the From domain? Did DKIM pass, and is the signing domain d= aligned with the From domain? One yes is enough; DMARC passes and the policy is not consulted. Two nos, and the message fails: the receiver applies p= to the fraction of messages given by pct=, treating the rest one step more leniently. Everything is then written into the daily aggregate report sent to the rua= address. That is the whole algorithm, and every DMARC surprise is one of those steps behaving as designed.
The three situations that fail
The ESP signs with its own domain. SPF passes because the ESP's bounce domain is in its SPF, DKIM passes because the ESP's key is valid — and neither is your domain, so nothing aligns. The fix is a custom DKIM key or custom return-path on your domain, which every serious sending tool supports. Forwarding. The forwarding server is not in your SPF, so SPF fails; DKIM survives if the forwarder did not touch the body. This is why DKIM is the mechanism that matters. Mailing lists. They rewrite the subject and add a footer, which breaks DKIM, and re-send from their own server, which breaks SPF. Lists deal with this by rewriting the From header when the sender is at p=reject, which is the one place ARC helps. The alignment checker reads these results out of real headers; this page lets you construct the case and see the rule.
pct and the ramp
pct= is how you move from none to reject without a cliff. At p=quarantine; pct=25, one failing message in four goes to spam and three are delivered as if the policy were none — all four are still reported. At p=reject; pct=50, half are rejected and half are quarantined, not delivered. Receivers implement the sampling per message, so a sender with a mis-set tool will see intermittent failures rather than a clean signal, which is confusing until you have seen this page explain it. Move pct up in steps and watch the aggregate reports at each one; the report parser shows the sources that are failing before the policy bites.
Subdomains
A message from news.acme.com looks first for _dmarc.news.acme.com. If that does not exist it uses _dmarc.acme.com and applies sp=, which defaults to p=. That default is the trap for cold email fleets: the primary at p=reject silently rejects every unaligned message from every secondary that has no record of its own. Either publish a record on each secondary — the generator builds them — or set sp= deliberately on the parent.
Frequently asked questions
Does DMARC require both SPF and DKIM to pass?
No — one aligned pass is enough. Gmail and Yahoo's bulk-sender rules separately require both to pass for high-volume senders, but that is their policy, not DMARC's.
What is the difference between relaxed and strict alignment?
Relaxed (the default) accepts any subdomain of the same organisational domain — mail.acme.com aligns with acme.com. Strict needs an exact match. Strict is rarely worth it; it breaks the moment a subdomain is introduced for anything.
Why does my failing mail still get delivered at p=reject?
Receivers may override the policy — Gmail sometimes quarantines instead of rejecting — and pct below 100 downgrades a share of messages. Also check whether the message is really evaluated under your record: a subdomain with its own p=none record wins over the parent's reject.
Does the simulator send anything?
No. It reads the DMARC record over DNS and does the arithmetic in your browser. Nothing you enter is stored.
Where do I see what receivers actually decided?
In the aggregate reports sent to rua=. Each row is a source IP with its SPF and DKIM results, alignment, and the disposition applied. Paste one into the DMARC report parser.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.