---
title: "Free DMARC checker and record validator"
description: "Check the DMARC record of any domain. See its policy, reporting addresses and alignment settings, and get a fix for every problem that leaves your domain open to spoofing."
canonical_url: "https://dnsense.io/dmarc-checker"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

<key-visual-subpage description="Look up the DMARC record of any domain, see what each tag does and whether the policy really stops spoofing." highlight="DMARC checker" imageAlt="Screenshot of TXT records in the DNSense DNS manager" imageUrl="spf-checker-hero.webp" title="DMARC checker">



</key-visual-subpage>

<dmarc-checker decorativeShape="top-right" highlight="DMARC record" label="Free DMARC tool" title="Check a DMARC record">



</dmarc-checker>

<text-content highlight="How DMARC works" label="Guide" title="How DMARC works and how to roll it out">

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with mail that fails both [SPF](https://dnsense.io/spf-checker) and [DKIM](https://dnsense.io/dkim-checker) for the domain in the visible From address. It also asks receivers to send you reports, so you can see everything that sends mail as your domain. Google and Yahoo require one from bulk senders.

The record is a [TXT record](https://dnsense.io/learn/txt-records-explained) on `_dmarc.yourdomain.com`, made of `tag=value` pairs.

<table>
<thead>
  <tr>
    <th>
      Tag
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        v=DMARC1
      </code>
    </td>
    
    <td>
      Marks the record as DMARC. It must come first.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        p=none
      </code>
      
      , <code>
        quarantine
      </code>
      
      , <code>
        reject
      </code>
    </td>
    
    <td>
      What receivers do with mail that fails: nothing, spam folder, or refuse.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        rua=mailto:dmarc@example.com
      </code>
    </td>
    
    <td>
      Where daily aggregate reports are sent.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        sp=
      </code>
    </td>
    
    <td>
      The policy for subdomains. Defaults to <code>
        p
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        pct=
      </code>
    </td>
    
    <td>
      The share of failing mail the policy applies to. Defaults to 100.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        adkim=
      </code>
      
      , <code>
        aspf=
      </code>
    </td>
    
    <td>
      Alignment: <code>
        r
      </code>
      
       (relaxed, the default) or <code>
        s
      </code>
      
       (strict).
    </td>
  </tr>
</tbody>
</table>

Start with `p=none` and a `rua` address, read the reports for a few weeks, fix every legitimate sender that fails, then move to `quarantine` and finally `reject`.

</text-content>

<faq :faqs="[{"question":"What is a DMARC record?","answer":"A DMARC record is a DNS TXT record on _dmarc.yourdomain that sets a policy for mail that fails SPF and DKIM, and says where receivers send reports about it."},{"question":"How do I check my DMARC record?","answer":"Enter your domain in the checker. It reads the TXT record on _dmarc.yourdomain, explains every tag and lists errors and warnings with a fix for each."},{"question":"Which DMARC policy should I use?","answer":"Start with p=none to collect reports without affecting delivery. When all your legitimate mail passes, move to p=quarantine and then p=reject, which stops spoofed mail from being delivered."},{"question":"Do I need SPF and DKIM for DMARC?","answer":"Yes. DMARC passes when SPF or DKIM passes and the domain aligns with the visible From address. Set up both, so a change at one of your senders does not break delivery."},{"question":"Why does the checker say my domain has no DMARC record?","answer":"DMARC is looked up on _dmarc.yourdomain, not on the domain itself. If you just published the record, wait for the TTL of the old answer to pass. Subdomains without their own record are covered by the policy of the parent domain, but this checker shows only the record on the domain you enter."},{"question":"Do you store the domains I check?","answer":"No. The checker looks up public DNS records for the domain you enter and shows the result."}]" decorativeShape="bottom-left" label="Questions" title="Frequently asked questions about DMARC">



</faq>

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.