DMarkyMARC

Rule editor

These rules decide PASS or FAIL for every check the site runs.

Rule 2 — accepted policies

p=none p=quarantine p=reject

A record whose policy is not on this list fails. p=none is monitoring only.

Rules 3–6 — reporting destinations

Require at least one rua= or ruf= destinationA record with no reporting is unauditable.

Reports going to the queried domain or a subdomain of it Self-pointing reports usually mean an unmonitored mailbox, not a processor.

FAIL WARN PASS

Strict: any single bad destination fails the recordOff by default. Left off, a record that also reports to a destination breaking no rule — a real aggregator alongside a self-pointing mailbox, say — is reported as WARN rather than FAIL, because reports still reach a usable processor.

Blocked destination domains — one per line

Matched on the destination domain and any subdomain of it. Google publishes no external-destination authorization, so reports there are silently discarded.

Restricted destination domains — one per line

Reports must not land in the corporate mail domain. Exempted by the approved namespaces below.

Approved reporting namespaces — one per line

Exempt from the self and restricted rules. This is what keeps dsghelp.com itself from failing on rua.dmarc.dsghelp.com.

Optional tightenings

Require an rua= aggregate destinationAggregate reports carry the signal; neither Google nor Microsoft sends failure reports at all. Require pct=100 when pct is presentpct below 100 substantially weakens an otherwise passing p=reject. Fail on sp=nonesp=none exempts every subdomain from the policy. Require fo=1The default fo=0 only reports when SPF and DKIM both fail. DSG's own record uses fo=1. Fail when external destination authorization is missing (RFC 7489 §7.1)Off by default, and reported as an advisory instead. Turning this on makes an unauthorized destination a FAIL.

Resolver

Every lookup goes through this DNS-over-HTTPS endpoint. A public one keeps the audit clear of split-horizon or filtered internal DNS.

Usage

Every check this site has run, and where it came from.

Passkeys & access

Everyone who can reach this console, and the passkeys they sign in with.

Name for a new passkey on your own account

Registration tokens

Single-use, time-limited. The token is shown once when created and stored only as a hash.

Label

Valid for (days)

Sign in

Enroll a new passkey

Rule editor

Rule 2 — accepted policies

Rules 3–6 — reporting destinations

Optional tightenings

Resolver

Usage

Passkeys & access

Registration tokens

Recent activity