DMARC Record Checker

Check a domain's DMARC record: the policy for mail that fails, where reports go and whether spoofed mail would be blocked. SPF and DKIM are checked alongside.

  • Free
  • No Sign-Up
  • Live Lookup

Examples:

How to Use

How to use the DMARC Checker

  1. 01

    Enter a domain

    Your email domain, or paste an address.

  2. 02

    Check

    The record at _dmarc.yourdomain is read and each tag explained.

  3. 03

    Plan the next step

    Most domains start at p=none, then move to quarantine and reject.

Email Authentication

About the DMARC Checker

What DMARC adds

SPF and DKIM each prove something about a message, but neither checks the From address people actually see. DMARC does: a message passes only if SPF or DKIM passes for a domain that matches the From domain (called alignment). The record then tells receivers what to do with mail that fails, and where to send reports.

Gmail and Yahoo require a DMARC record from anyone sending more than 5,000 messages a day, and it is the main protection against someone spoofing your domain.

TagMeaning
p=Policy: none (report only), quarantine (spam folder) or reject
sp=Policy for subdomains, if different
rua=Where daily aggregate reports are sent
ruf=Where failure samples are sent (few receivers send them)
pct=Share of failing mail the policy applies to
adkim= / aspf=Alignment: r (relaxed, subdomains match) or s (strict)

Moving to reject safely

Start with p=none and a rua address, and read the reports for a couple of weeks. They show every server sending as your domain. Once every legitimate sender passes SPF or DKIM with alignment, move to p=quarantine, then p=reject.

DMARC Tags and Policies

p=nonep=quarantinep=rejectrua=ruf=pct=adkim= and aspf=sp=

What it can't tell you

  • It reads the published record. It cannot show what reports say or which senders currently fail.
  • Organisational domain lookups (falling back from a subdomain to its parent) are not followed.

Frequently asked questions

Is p=none enough?
No for protection, yes for a start. p=none only asks for reports; spoofed mail is still delivered. Aim for quarantine or reject.
Do I need SPF and DKIM for DMARC?
You need at least one of them to pass with alignment for each legitimate message. Set up both, as forwarding often breaks SPF while DKIM survives it.
Where do DMARC reports go?
To the mailto: addresses in rua=. They are XML files, so most people use a free report viewer or a DMARC service to read them.

Free Tools

More tools

All Tools
SPF CheckerValidate an SPF record and count its DNS lookups against the limit of 10.DKIM CheckerFind and validate a domain's DKIM public keys by selector.DNS LookupA, AAAA, MX, NS, TXT, CNAME, SOA and CAA records for any domain.IP Reputation CheckerCheck an IP against spam blocklists and threat feeds at once.

Your customers' VMs sending spam?

Frabs spots outbound spam from any VM within seconds and stops it, before your IPs end up on a blocklist.

Start Free TrialTry the Demo