Google, Microsoft, Yahoo and other mailbox providers send a daily report to the addresses in your DMARC record’s rua= list. The reports say which servers sent mail as your domain and whether it passed. Uptimecheck reads them for you, names the senders, and tells you when it is safe to enforce DMARC. It works on every plan, Free included.
Turn it on
- Open a Domain & email monitor with Check email authentication on. Each one has its own report address, such as
dmarc+3f9a0c2e7b1d4a6c8e0f2b4d@reports.uptimecheck.com. - Under DMARC reports, copy the DMARC record and publish it at your DNS provider. If you already have a record, it is the same record with our address added to
rua=, and the addresses you have stay. - That is all. Reports arrive about once a day, so the first ones show up within a day or two.
With no DMARC record yet, the one we suggest only collects reports (p=none), so nothing changes for your mail. A subdomain without a record of its own follows its parent domain’s; the card then gives it a record of its own, with the parent’s policy.
What you see
- Messages, the share Passing DMARC, the number of Senders and of Reports, over the last 7 or 30 days.
- Every sender, named from its servers and DKIM signatures, such as Google Workspace, Microsoft 365, SendGrid, Mailchimp and Klaviyo. The rest show as Unknown sender with the IP address.
- For each sender, whether SPF and DKIM line up with your domain and how many messages passed DMARC. Mail passes when SPF or DKIM passes for your own domain.
- For a known service that fails, the fix, such as an SPF include or turning on DKIM in that service.
When to move to quarantine
After 14 days of reports where every sender of yours passes, the card says it is safe to move from p=none to p=quarantine, and gives you the record. Later you can move to p=reject. Then fake mail in your name stops reaching inboxes. The advice is based on the reports of the last 14 days only: if reports stop arriving, for example because the address was taken out of the record, the card goes back to collecting.
Alerts
The monitor’s alert channels hear about it when a new unknown sender fails DMARC, which may be someone spoofing your domain, or when a sender that passed starts failing. Alerts start after 3 days of reports, and each sender alerts at most once a week. Reports are kept for 90 days.
See how to check SPF, DKIM and DMARC and email authentication monitoring.