DMARC+ FAQ
Basics
What is the difference between SPF, DKIM and DMARC? SPF lists servers allowed to send. DKIM signs messages. DMARC requires that SPF or DKIM pass and align with the visible From domain, and sets the policy and reporting. See What is DMARC?.
Will DMARC stop all phishing? No. It stops others from sending mail that uses your exact domain in the From address, at receivers that honor your policy. It does not stop look-alike domains or compromised accounts.
Does publishing DMARC block my mail? Not at p=none. Only quarantine and reject can affect delivery of failing mail.
How long until I can enforce? It depends on your senders. Many organizations need several weeks of monitoring, longer if some senders only send monthly or quarterly. See From monitoring to enforcement.
Do I need SPF and DKIM both? DMARC needs one aligned pass. Having both is safer, because forwarding breaks SPF and some services cannot sign.
Using DMARC+
Where do I add a domain? DMARC+ > Domains. See Add and manage domains.
Why is the DKIM selector required? DMARC+ checks the DKIM record only at the selector you provide. Use the selector of your main mail system.
How fresh is the data? Receivers send reports about once a day. Expect a delay of a day or more. Recent days can be incomplete.
Why is my dashboard empty? The domain may be new, the record may not point to your DMARC+ address, or your domain may have very low mail volume. See Troubleshooting.
Can I export the data? The explorer has no file export at the time of writing. Use formatted reports to share results.
What does "Policy Evaluated" mean? It is the action the receiver took, not your published policy.
Why do some charts say Compliant when mail fails? Some charts group mail by what the receiver did. At p=none receivers deliver everything, so failing mail is grouped as Compliant. See Dashboard.
What is a parked domain? A domain that never sends mail. Turn on Parked Domain when adding it, and publish a reject policy and an SPF record that allows nothing. See Parked domains.
What is a managed record? A record hosted by DMARC+ that your DNS points to with a CNAME, so you can change it in DMARC+. See Managed record tools.
Reports
Why is the Forensic Reports page empty? Few receivers send failure reports. See Forensic reports.
Can I choose the weekly report day? The weekly email follows the platform's schedule. Use a scheduled formatted report for a fixed day.
Who receives the weekly report? Members of your organization, when the DMARC module is enabled.
Access
I cannot see DMARC+ in the menu. The DMARC module may not be enabled for your account or your role. Ask an administrator.
Does my plan include DMARC+? This depends on your plan and contract. Check with your account team.
Security
Are forensic reports sensitive? Yes. They can include personal data from the failed messages.
Does DMARC+ store message content? Aggregate reports contain counts and IP addresses. Forensic reports may contain message details. Contact support for current retention terms.