Check your DMARC record.
See whether a domain's DMARC policy actually stops fake email, whether reports reach anyone, and what to change next. Plain language, with the record to copy.
What your DMARC record says
What DMARC does
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do when a message claiming to be from you fails SPF and DKIM, and where to send reports about it.
The three policies
p=none only watches and reports: fake mail is still delivered. p=quarantine sends failing mail to spam. p=reject blocks it. Start with none, read the reports, then move up.
The tags you will see
rua is the address for daily summary reports. pct sets how much failing mail the policy covers. sp sets the policy for subdomains. adkim and aspf choose strict (s) or relaxed (r) matching between the From domain and the SPF or DKIM domain.
Why it matters now
Since February 2024, Gmail and Yahoo require DMARC from anyone sending bulk email. Without it, messages get rejected or land in spam, and anyone can send mail that looks like yours.