DMARC Checker |
A DMARC checker shows whether a domain publishes a DMARC policy and what it asks receivers to do with mail
that fails SPF and DKIM: deliver it anyway (p=none), put it in spam (quarantine)
or refuse it (reject).
From p=none to p=reject, Safely
Monitor first, fix your senders, then tighten the policy one step at a time.
- Publish
v=DMARC1; p=none; rua=mailto:you@yourdomainat_dmarc. Nothing changes for your mail; you start getting reports. - Read the reports for two to four weeks. For every service that sends as your domain (mail provider, newsletter, CRM, helpdesk), make SPF or DKIM pass with your domain. Report reader ↓
- Optional: switch to
p=quarantine; t=y. In test mode receivers treat it asnone, so you can watch the reports one more time (receivers still on RFC 7489 ignoret=y). - Set
p=quarantine: failing mail goes to spam. Check the reports for legitimate mail that fails. - Set
p=reject: failing mail is refused. Spoofed mail using your domain stops reaching inboxes.
Read Your DMARC Reports
Drop the reports you receive at your rua= address: you'll see every server that sent mail as your domain and whether it passed.
Or paste the XML of one report
| Sending IP | Messages | DMARC | SPF (domain, result) | DKIM (domain, selector, result) | Receiver did |
|---|
Only the 300 busiest sources are listed.
DMARC passes when SPF or DKIM passes and its domain matches the From domain (alignment). A source can show SPF "pass" for another domain and still fail DMARC.
What Is DMARC?
DMARC is a DNS record that tells receivers what to do with mail claiming to be from your domain when it fails authentication, and where to send reports.
SPF lists the servers allowed to send for a domain; DKIM signs messages with a key published in DNS. Neither checks
the address people actually see in the From line. DMARC adds that check: a message passes when SPF or DKIM passes
for the same domain as the From address. The record lives at _dmarc. plus the domain and starts with
v=DMARC1. Since February 2024, Gmail and Yahoo require one from bulk senders.
| Tag | Meaning |
|---|---|
p= | Policy: none, quarantine or reject (required) |
rua= | Where daily aggregate reports go (mailto: addresses) |
sp= · np= | Policy for subdomains · for subdomains that don't exist (RFC 9989) |
adkim= · aspf= | Alignment: r relaxed (subdomains match, default) or s strict |
t=y | Test mode: receivers apply one step less (RFC 9989) |
ruf= · fo= | Failure reports and when to send them; few receivers send them |
How This DMARC Check Works
| Query | Live TXT query through Google Public DNS, no cache: _dmarc. plus the domain, then the parent domains with the RFC 9989 tree walk (at most 8 queries), as receivers do |
| Checks | One record only, valid policy, report addresses, permission for external report addresses (RFC 9990), a DMARC record wrongly published on the domain itself |
| Same as | The DMARC part of the TXT lookup: both pages give the same verdict |
| Reports | Read in your browser (XML, gzip and zip unpacked locally); nothing is uploaded |
| Runs on | Our server in the US (AWS, N. Virginia) |
| What we keep | Lookups are not saved. Our server and Cloudflare keep standard access logs. |
Last verified 10 November 2026.
Frequently Asked Questions
How do I check my DMARC record?
nslookup -type=txt _dmarc.example.com.
What DMARC policy should I use?
p=none and a rua= address to receive reports. When the reports show that all
your real mail passes SPF or DKIM, move to p=quarantine, then p=reject. Only quarantine
and reject stop other people from sending mail as your domain.
Do subdomains need their own DMARC record?
sp= policy
if there is one. This check finds it the way receivers do and says where the record came from.
How do I read DMARC reports?
rua= address, usually zipped. Drop them in the report
reader on this page: it lists every server that sent mail as your domain and whether it passed, and the files
never leave your browser.
Put this guide into practice