DMARC Star Fighter
DMARC Star Fighter is a free browser game that teaches DMARC in four chapters. You defend a fictional domain, starship.com, by doing the same four things you would do on a real one: publish a monitoring record, work out which senders are legitimate, raise enforcement, and keep watching the reports.
It takes about ten minutes, needs no signup or download, and assumes you know nothing about email authentication when you start.
What each chapter teaches
- Chapter 1 — SetupPublish a DMARC record at _dmarc.yourdomain.com with v=DMARC1, p=none and a rua address. That asks receivers for reports without asking them to block anything yet.
- Chapter 2 — AlignmentDMARC passes when SPF or DKIM passes and aligns with the domain in the From address a reader actually sees. A third-party sender can authenticate perfectly and still fail DMARC if it is not aligned.
- Chapter 3 — EnforcementOnce every authorized sender passes, raise the requested policy from p=none to quarantine and then reject. The policy is a request - each receiving system makes the final handling decision.
- Chapter 4 — MonitoringReports keep arriving as senders change. A DMARC failure is a clue, not proof of an attack, so compare each failing source against your authorized sender list before acting.
Frequently asked questions
- Is DMARC Star Fighter free?
- Yes. It runs in your browser with no signup and no download, and there is nothing to install or pay for.
- Do I need to understand DMARC before playing?
- No. The game starts from zero and teaches one idea per chapter, in the order you would actually roll DMARC out on a real domain.
- How long does it take to finish?
- About ten minutes for all four chapters on a first run, and the campaign carries continues so a lost run does not send you back to the start.
- What is DMARC?
- DMARC is an email authentication standard that ties SPF and DKIM results to the visible From domain, tells receivers what to do with messages that fail, and sends the domain owner reports about who is sending as them.
Do it on your own domain
The game is a rehearsal. When you want the real thing, start with what DMARC is and how it works, then build your record with the DMARC record generator and check what is already published with the DMARC record checker.