INITIALIZING DMARC STAR FIGHTERLoading fighter systems and DMARC training data…

DMARC Star Fighter: a free browser game that teaches DMARC

DMARC Star Fighter is a free browser game that teaches DMARC in four chapters. You defend a fictional domain, starbase.domain, by doing the same four things you would do on a real one: publish a monitoring record, work out which senders are legitimate, raise enforcement, and keep watching the reports.

It takes about ten minutes, needs no signup or download, and assumes you know nothing about email authentication when you start.

What does DMARC Star Fighter teach?

Chapter 1, SetupPublish a DMARC record at _dmarc.yourdomain.com with v=DMARC1, p=none and a rua address. That asks receivers for reports without asking them to block anything yet.
Chapter 2, AlignmentDMARC passes when SPF or DKIM passes and aligns with the domain in the From address a reader actually sees. A third-party sender can authenticate perfectly and still fail DMARC if it is not aligned.
Chapter 3, EnforcementOnce every authorized sender passes, raise the requested policy from p=none to quarantine and then reject. The policy is a request. Each receiving system makes the final handling decision.
Chapter 4, MonitoringReports keep arriving as senders change. A DMARC failure is a clue, not proof of an attack, so compare each failing source against your authorized sender list before acting.

Where do I see the high scores?

Every finished run is ranked on the DMARC Star Fighter leaderboard, all time and for the current UTC day. One row per pilot, best score only, and no account needed to appear on it.

Frequently asked questions

What is DMARC?: DMARC is an email authentication standard that ties SPF and DKIM results to the visible From domain, tells receivers what to do with messages that fail, and sends the domain owner reports about who is sending as them.
Is DMARC Star Fighter free?: Yes. It runs in your browser with no signup and no download, and there is nothing to install or pay for.
Do I need to understand DMARC before playing?: No. The game starts from zero and teaches one idea per chapter, in the order you would actually roll DMARC out on a real domain.
How long does it take to finish?: About ten minutes for all four chapters on a first run, and the campaign carries continues so a lost run does not send you back to the start.
Does it teach real DMARC or a simplified version?: The record syntax, the tags, and the rollout order are real. What is compressed is time: a real rollout takes weeks of reading reports between each policy change, and the game collapses that into four chapters.
Can I use it for security awareness training?: Yes. It needs no signup, no download, and no account to hand out, so a team can play it from a link. It teaches the domain owner's side of DMARC rather than how to spot a phishing email.

Do it on your own domain

The game is a rehearsal. To see where your own domain actually stands, run a free email security score: it checks SPF, DKIM, and DMARC together and needs no signup.

From there, read what DMARC is and how it works, build your record with the DMARC record generator, and check what is already published with the DMARC record checker.

CONNECTING DOMAIN BEACON

DMARC Star Fighter: a free browser game that teaches DMARC

It takes about ten minutes, needs no signup or download, and assumes you know nothing about email authentication when you start.

What does DMARC Star Fighter teach?

Chapter 1, SetupPublish a DMARC record at _dmarc.yourdomain.com with v=DMARC1, p=none and a rua address. That asks receivers for reports without asking them to block anything yet.

Chapter 2, AlignmentDMARC passes when SPF or DKIM passes and aligns with the domain in the From address a reader actually sees. A third-party sender can authenticate perfectly and still fail DMARC if it is not aligned.

Chapter 3, EnforcementOnce every authorized sender passes, raise the requested policy from p=none to quarantine and then reject. The policy is a request. Each receiving system makes the final handling decision.

Chapter 4, MonitoringReports keep arriving as senders change. A DMARC failure is a clue, not proof of an attack, so compare each failing source against your authorized sender list before acting.

Frequently asked questions

What is DMARC?

DMARC is an email authentication standard that ties SPF and DKIM results to the visible From domain, tells receivers what to do with messages that fail, and sends the domain owner reports about who is sending as them.

Is DMARC Star Fighter free?

Yes. It runs in your browser with no signup and no download, and there is nothing to install or pay for.

Do I need to understand DMARC before playing?

No. The game starts from zero and teaches one idea per chapter, in the order you would actually roll DMARC out on a real domain.

How long does it take to finish?

About ten minutes for all four chapters on a first run, and the campaign carries continues so a lost run does not send you back to the start.

Does it teach real DMARC or a simplified version?

The record syntax, the tags, and the rollout order are real. What is compressed is time: a real rollout takes weeks of reading reports between each policy change, and the game collapses that into four chapters.

Can I use it for security awareness training?

Yes. It needs no signup, no download, and no account to hand out, so a team can play it from a link. It teaches the domain owner's side of DMARC rather than how to spot a phishing email.

Do it on your own domain

The game is a rehearsal. To see where your own domain actually stands, run a free email security score: it checks SPF, DKIM, and DMARC together and needs no signup.