DMARC setup checklist and deliverability diagnostics

Two endpoints do the thinking so you do not have to read reports by hand. Both are Starter and up, because they join the DNS scan with 30 days of DMARC reports.

The setup checklist

GET /api/dmarc/setup-status?domain=… (the setup panel on the web and in the app; tool get_dmarc_setup_status) returns five steps, each with a state:

1. SPF - a valid TXT record at the apex.
2. DKIM - a key published for the provider that sends your mail.
3. DMARC - the _dmarc TXT record, generated by DomainGuard with your report address.
4. Wait for reports - the first should arrive within 24 to 48 hours.
5. Inbox routing - rua= points at DomainGuard's address and not somewhere else.

Steps 4 and 5 are the two people get wrong. A checklist that looks finished but has rua= pointed at a mailbox nobody reads produces no reports and looks broken.

The diagnostic

GET /api/dmarc/diagnostics?domain=… (the "Why is my email going to spam?" card; tool get_dmarc_diagnostics) returns the inputs it used and a ranked list of findings, most likely cause first, each with its own fix:

The failure modes it distinguishes: missing DMARC record, broken DMARC record, an unrecognised sender with material failure, a misconfigured sending service, and reports having stopped arriving. Lead with the first entry; the rest are ordered by likelihood.

When to tighten the policy

A domain is safe to move off p=none when it has two weeks of reports with 95% of mail passing SPF or DKIM. Both halves matter: high alignment with four days of data is not evidence, and two weeks at 60% alignment means something is still misconfigured. The diagnostic reports days_observed and alignment_rate against that rule.

Move none to quarantine, watch another two weeks, then reject. Managed email authentication can make those moves for you without further DNS edits.

Where

• Web: Monitor, DMARC, the Setup and Diagnostics cards; also the domain's Email & DMARC module.
• iOS: the DMARC page under a domain's Email & DMARC module.

Common questions

The diagnostic says "reports stopped". Check that the DMARC record still carries the current rua= address (rotating the inbox changes it) and that the record was not replaced by a provider's setup wizard.

Alignment is 99% but one sender fails. That sender is usually a form plugin, a CRM or a printer sending as your domain without being in SPF. Add it to SPF or configure DKIM for it; the senders list names the IP and, where recognised, the provider.