The term covers two different jobs, and tools usually do only one of them. Knowing which you need saves money and confusion.
Part one: the record
This is checking the DMARC record itself. Is it published? Does it parse? What is the policy, and is there a report address? Did it change since yesterday?
Failures here are easy to cause and expensive to miss. A deleted record means no protection at all and, for senders subject to Gmail and Yahoo’s rules, possible rejections. A hurried edit can set a policy you did not intend.
Part two: the reports
Receivers that support DMARC send daily aggregate reports to the address in your rua tag. Analysing them tells you:
- which services send mail as your domain,
- which of them pass and which fail,
- whether anyone is spoofing you,
- when you are ready to move to enforcement.
This part takes a service, because the raw XML is not meant for people.
Which you need
| Situation | What helps |
|---|---|
| One sender, such as SES, already passing | The record check, to catch breakage |
| Several tools sending as your domain | Reports, to find the ones that fail |
Moving from p=none to p=reject |
Both: reports to prove it is safe, the check to keep it that way |
With Amazon SES
Your SES mail passes when DKIM is signed on your domain or SPF is aligned through a custom MAIL FROM domain. Reports confirm that. Records and reports belong together, and the record check sits with the rest of DNS monitoring.
Common questions
Do I need a paid DMARC report service?
Not at first. Many senders get what they need from the record check and the occasional report. A service becomes worth it when you have several senders on your domain or want to move to enforcement with confidence.
Do I need both parts?
Over time, yes. The record check tells you the setup is intact, and reports tell you who is using your domain and whether they pass.