Back to Free Tools

    DMARC Policy Impact Simulator

    See the impact of moving from p=none to quarantine or reject before you change it.

    Simulate a DMARC policy change

    Try:

    Custom DKIM selectors (optional)

    We always probe ~17 common selectors. Add your vendor-specific selectors (e.g. hs1-12345, zendesk1) to check them too. Up to 20.

    What is a DMARC policy change?

    DMARC tells receivers what to do with mail that fails authentication: monitor (p=none), deliver to spam (p=quarantine), or reject outright (p=reject). Moving up the ladder protects your domain from spoofing — but breaks any legitimate sender that isn't authenticating correctly. The point of a policy simulator is to find those broken senders before they cost you mail.

    What this simulator checks

    • Current DMARC policy (p=, sp=, pct=, rua= presence)
    • SPF record and any third-party senders that often break alignment
    • DKIM probing on ~17 common selectors used by Workspace, 365, and major ESPs
    • Readiness for p=quarantine with blockers and warnings
    • Readiness for p=reject with blockers and warnings
    • A single concrete recommendation for the next safe step

    DMARC policy ladder

    PolicyReceiver actionWhen to use
    p=noneDeliver as normal; report failuresInitial monitoring. Always start here.
    p=quarantineRoute failing mail to spamAfter 2–4 weeks of clean reports at p=none.
    p=rejectRefuse failing mail at SMTPAfter 2–4 weeks of clean reports at quarantine.

    How to roll out DMARC safely

    • Publish p=none with rua=mailto: before changing anything else
    • Inventory every sender (use the Sender Classification Lookup) and confirm each one signs DKIM aligned with your domain
    • Move to p=quarantine; pct=10 and ramp pct over weeks while watching rua reports
    • Move to p=reject; pct=100 only after a clean run at quarantine
    • Keep monitoring — every new sender added to your stack restarts the readiness check

    DKIM selectors we probe automatically

    Every check looks up these 17 selectors under <selector>._domainkey.<domain>. If your vendor uses a different selector, add it as a custom selector above.

    SelectorCommonly used by
    defaultGeneric default (many self-hosted MTAs)
    googleGoogle Workspace
    selector1Microsoft 365 (primary)
    selector2Microsoft 365 (secondary)
    s1SendGrid, generic
    s2SendGrid, generic
    k1Mailchimp, Mailgun, Klaviyo
    k2Mailchimp / Mailgun rotation
    k3Mailchimp / Mailgun rotation
    mandrillMandrill
    smtpapiSendGrid legacy
    mxvaultMXroute / mxvault
    dkimGeneric DKIM
    mailBrevo (Sendinblue), generic
    mailgunMailgun
    pmPostmark
    scph0820SparkPost / SocketLabs

    Frequently asked questions

    Related free tools

    References

    Go beyond one-off checks

    Safer Sender continuously monitors your domain's DMARC, SPF and DKIM, classifies every sender, and guides you safely from p=none to p=reject.

    Start Free View pricing