DMARC record checker

Find a domain’s DMARC record and see what each tag asks receiving servers to do.

What is DMARC?

Domain-based Message Authentication, Reporting and Conformance (DMARC) is a DNS TXT record published at _dmarc.yourdomain.com. It tells receiving mail servers what to do with a message that claims to be from your domain but fails authentication, and where to send reports about it. A message passes DMARC when SPF or DKIM passes and the passing domain aligns with the domain in the visible From address.

The tags this checker explains

• p is the policy for your domain: none only monitors, quarantine asks receivers to treat failures as suspicious, and reject asks them to refuse failures.
• sp sets a different policy for subdomains. If it is missing, subdomains follow p.
• rua and ruf are mailto addresses for aggregate and forensic reports. Aggregate reports are how you discover every system that sends as your domain, so a record without rua gives you little visibility.
• pct is the share of failing messages the policy applies to, from 0 to 100, and defaults to 100. It is useful while rolling out a stricter policy.
• adkim and aspf choose relaxed (r) or strict (s) alignment for DKIM and SPF. Relaxed is the default and allows subdomains of the same organisational domain to match.

A sensible rollout

Most domains start with p=none and a rua address, read the reports for a few weeks, fix legitimate senders that fail alignment, then move to quarantine and finally reject, optionally stepping up pct along the way. Jumping straight to reject can block your own newsletters, invoices or support tool if any of them is not set up to align.

What a DMARC record does not tell you

A strong policy protects your domain from being spoofed. It does not prove that a specific mailbox exists, and it does not guarantee that your messages reach the inbox; reputation, content and recipient behaviour all play a part. Major mailbox providers have also published sender requirements that include authentication for bulk senders, so it is worth checking the current guidelines of the providers you send to.

Related checks

DMARC depends on SPF and DKIM, so check the SPF record and your DKIM selector as well. The MX record lookup shows where your incoming mail goes, and the sending setup guide walks through preparing a sending domain.