Skip to main content
Get started

DMARC checker

Look up the DMARC record of any domain, see what each tag does and whether the policy really stops spoofing.

Screenshot of TXT records in the DNSense DNS manager
Free DMARC tool

Check a DMARC record

Guide

How DMARC works and how to roll it out

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with mail that fails both SPF and DKIM for the domain in the visible From address. It also asks receivers to send you reports, so you can see everything that sends mail as your domain. Google and Yahoo require one from bulk senders.

The record is a TXT record on _dmarc.yourdomain.com, made of tag=value pairs.

TagMeaning
v=DMARC1Marks the record as DMARC. It must come first.
p=none, quarantine, rejectWhat receivers do with mail that fails: nothing, spam folder, or refuse.
rua=mailto:[email protected]Where daily aggregate reports are sent.
sp=The policy for subdomains. Defaults to p.
pct=The share of failing mail the policy applies to. Defaults to 100.
adkim=, aspf=Alignment: r (relaxed, the default) or s (strict).

Start with p=none and a rua address, read the reports for a few weeks, fix every legitimate sender that fails, then move to quarantine and finally reject.

Questions

Frequently asked questions about DMARC

A DMARC record is a DNS TXT record on _dmarc.yourdomain that sets a policy for mail that fails SPF and DKIM, and says where receivers send reports about it.

Enter your domain in the checker. It reads the TXT record on _dmarc.yourdomain, explains every tag and lists errors and warnings with a fix for each.

Start with p=none to collect reports without affecting delivery. When all your legitimate mail passes, move to p=quarantine and then p=reject, which stops spoofed mail from being delivered.

Yes. DMARC passes when SPF or DKIM passes and the domain aligns with the visible From address. Set up both, so a change at one of your senders does not break delivery.

DMARC is looked up on _dmarc.yourdomain, not on the domain itself. If you just published the record, wait for the TTL of the old answer to pass. Subdomains without their own record are covered by the policy of the parent domain, but this checker shows only the record on the domain you enter.

No. The checker looks up public DNS records for the domain you enter and shows the result.