Policy Advisor and DNS recheck
DMARC only blocks spoofing once you enforce it, and the whole journey from monitoring to enforcement is a walk up one setting: p=. The Policy advisor card on each domain's dashboard shows where you are on that walk, what the sensible next step is, and — via the Recheck DNS button — what your domain is publishing right now, not what last week's reports observed.
The enforcement ramp
The advisor draws your domain's position on a three-stage ramp:
p=none— Monitoring. Reports flow, nothing is blocked.p=quarantine · pct=25— Quarantine, ramped. Failing mail starts going to spam for a percentage of traffic, stepped up 25 → 50 → 100% as confidence grows.p=reject— Full enforcement. Mail that fails DMARC is refused; spoofing is blocked.
Your current stage is marked "you are here", and the following stage is labelled as the recommended next step. The card's heading tracks reality too: it reads "Time to enforce" with an action pill until you publish p=reject, at which point it flips to "Fully enforced". The reasoning behind each stage — and why the intermediate quarantine ramp exists at all — is covered in DMARC policy: none, quarantine, reject.
Crucially, the ramp is driven by your published policy. The advisor never grades you against an aspiration; it reads what your DMARC record actually says and positions you from that.
Reports lag DNS — Recheck fixes that
By default the dashboard learns your policy the same way it learns everything else: from aggregate reports, which describe what receiving servers observed over a past period. That view can lag a DNS edit by a day or more — you publish p=quarantine this morning, and the reports still say p=none until tomorrow's batch arrives.
The Recheck DNS button closes that gap. Clicking it makes your browser look up _dmarc.yourdomain.com directly over DNS-over-HTTPS (querying Google's public resolver, with Cloudflare as fallback) and reads the record you are publishing at this moment. The dashboard also runs this check automatically the first time you open a domain, so the advisor is usually live-accurate before you've touched anything; the button forces a fresh lookup whenever you want one — typically thirty seconds after editing DNS, to confirm the change is visible to the world.
There are three possible outcomes, and the card states each one plainly:
- Live DNS ✓ — a DMARC record was found. The current-policy line and the ramp now reflect the live record.
- No DMARC record found — the lookup succeeded but
_dmarc.yourdomain.comhas no DMARC record. If you've just published one, DNS propagation may still be in progress. - Couldn't reach DNS — the lookup itself failed (network trouble), and the dashboard says it is showing the latest report-derived data instead.
What the recheck does not do
This feature is deliberately display-only. It updates what the advisor and the current-policy line show in your browser — nothing more:
- It never changes your DNS. Advancing your policy is always an edit you make at your DNS host.
- It stores nothing. The live result isn't written back to your account; the next report cycle remains the durable record.
- It recommends; you decide. The advisor's next-step suggestion is guidance, not automation. The "Advance policy safely" button takes you to your domain's settings, where the DNS record and verification live.
Advancing with confidence
The advisor tells you where you are; the rest of the dashboard tells you whether you're ready to move. Before stepping up the ramp, the test is simple: every legitimate source in your sending-sources table passes, over a window long enough to include your infrequent senders. When something still fails, fix its alignment first — the tag-by-tag reference in DMARC record tags explained covers the record syntax you'll be editing, including pct= for the quarantine ramp.
Enforcement is a decision you make once per stage, with evidence. The advisor's job is to make sure the evidence and the decision are never about a stale record.