DMARC Checker - Look Up and Validate DMARC Records
Check whether a domain publishes a DMARC policy, whether it actually blocks spoofed mail, and where reports go, with every tag explained in plain English.
DMARC Tags Reference
| Tag | Values | Purpose |
|---|---|---|
| v | DMARC1 | Required. Must be the first tag. |
| p | none | quarantine | reject | Required. Policy for the domain. |
| sp | none | quarantine | reject | Policy for subdomains. Defaults to p. |
| rua | mailto:addr | Aggregate report destinations. |
| ruf | mailto:addr | Forensic report destinations (few receivers send them). |
| pct | 0-100 | Share of failing mail the policy applies to. Default 100. |
| adkim | r | s | DKIM alignment mode. Default relaxed. |
| aspf | r | s | SPF alignment mode. Default relaxed. |
| fo | 0 | 1 | d | s | When to generate forensic reports. |
Moving from p=none to p=reject Safely
- Publish
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comand collect reports for two to four weeks. - Find every legitimate source in the reports and make sure it passes SPF or DKIM with alignment. Use the SPF checker and DKIM checker to confirm.
- Switch to
p=quarantine; pct=25, then raise pct gradually to 100. - Finish with
p=reject. Spoofed mail is now refused by receivers that honor DMARC.
Need a record? Build one with the DMARC record generator.
DMARC FAQ
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a DNS TXT record at _dmarc.yourdomain.com. It tells receivers what to do with mail that fails both SPF and DKIM alignment (nothing, quarantine or reject) and where to send reports about it.
Is p=none enough?
p=none is the right first step because it turns on reporting without affecting delivery, but it does not stop spoofing. Gmail and Yahoo require at least p=none for bulk senders. Move to p=quarantine and then p=reject once reports show your legitimate mail passes.
What is DMARC alignment?
DMARC passes only if SPF or DKIM passes for a domain that matches the visible From address. With relaxed alignment (the default), mail.example.com aligns with example.com. With strict alignment (adkim=s or aspf=s) the domains must match exactly.
Do subdomains need their own DMARC record?
No. If a subdomain has no record, receivers use the organizational domain's record and apply its sp= policy (or p= when sp is absent). A subdomain only needs its own record if it should behave differently.
Why don't I receive DMARC reports?
Check that rua= uses the mailto: prefix and a working mailbox. If the address is on a different domain than the one being reported on, that domain must publish an authorization record at example.com._report._dmarc.reportdomain.com. Reports arrive about once a day and only from receivers that send them.
More Free Email Tools
MX Lookup
Find the mail servers for a domain, their priority, IPs and email provider
SPF Record Checker
Validate an SPF record, count DNS lookups and expand every include
SPF Record Generator
Build a valid SPF record for Google Workspace, Microsoft 365, SES and more
DMARC Record Generator
Create a DMARC TXT record with policy, reports and alignment settings
DKIM Record Checker
Check a DKIM selector, read the public key and its length, or scan common selectors
SMTP Test Tool
Open a live SMTP session, test TLS and authentication, and send a test email