DMARC Checker

What is a DMARC record?

Reviewed by Prabath Thalangama · Last updated October 22, 2026

A DMARC record is a DNS TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment: nothing (p=none), send to spam (quarantine) or reject them. It also says where to send reports. This checker fetches, parses and explains it.

DMARC is the only one of the three email authentication standards that protects the From address people actually see. A message passes DMARC when SPF or DKIM passes for a domain that matches (aligns with) the From domain.

Since February 2024, Google and Yahoo require a DMARC record from anyone sending more than 5,000 messages a day to their users. A policy of p=none satisfies that requirement, but only an enforcing policy stops spoofing.

How do I check my DMARC record?

Enter your domain, for example example.com. The tool looks up _dmarc.example.com for you.
Read the policy and each tag explanation, then the findings.
If there is no record, build one with the DMARC generator and publish it as a TXT record with the host _dmarc.

How to read the results

p (policy): What receivers should do with failing mail: none (monitor only), quarantine (spam folder) or reject.
sp (subdomain policy): The policy for subdomains. If absent, subdomains inherit p.
pct: The percentage of failing mail the policy applies to. Defaults to 100.
rua / ruf: Where aggregate (daily XML summary) and forensic (per-message) reports are sent, as mailto: addresses.
adkim / aspf: Alignment mode for DKIM and SPF: r (relaxed, subdomains of the same organisational domain match) or s (strict, exact match). Default is relaxed.
Findings: This tool flags a missing record, a policy that does not enforce (p=none) and a missing aggregate report address.

Why is my DMARC failing?

SPF and DKIM pass, but not for your domain

DMARC needs alignment. If a newsletter or CRM service sends with its own Return-Path and signs with its own DKIM domain, both checks pass for that service's domain and DMARC still fails for yours. Set up a custom return-path (bounce domain) and DKIM signing with your domain in each service.

The record is in the wrong place

DMARC must be a TXT record at the host _dmarc. A v=DMARC1 record at the root of the domain is ignored.

Stuck at p=none

p=none only collects reports. Review the aggregate reports for a few weeks until every legitimate source passes with alignment, then move to p=quarantine (optionally with pct to phase it in) and finally p=reject.

Reports never arrive at an external address

When rua points at a mailbox on another domain, that domain must publish an authorization record, or receivers will not send reports there. Report services publish this for you.

; on the report receiver's domain
example.com._report._dmarc.reports.example.net. TXT "v=DMARC1"

Examples and command-line equivalents

Start: monitor only

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

Phase in enforcement

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]"

Full enforcement

_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"

Check DMARC from the command line

dig +short TXT _dmarc.example.com
nslookup -type=TXT _dmarc.example.com

Frequently asked questions

Is p=none enough?

It is enough to meet the Google and Yahoo bulk-sender requirement and to start receiving reports, but it does not stop anyone spoofing your domain. Move to quarantine and then reject once reports show your legitimate mail is aligned.

What is DMARC alignment?

Alignment means the domain that passed SPF (the envelope sender) or DKIM (the d= signing domain) matches the From header domain. In relaxed mode, mail.example.com aligns with example.com; in strict mode it must be identical.

Do I need both SPF and DKIM for DMARC?

DMARC passes if either one passes with alignment. Set up both: DKIM survives forwarding, while SPF does not.

Does DMARC apply to subdomains?

Yes. Subdomains use the sp= policy, or inherit p= if sp is not set. That is why p=reject on the organisational domain also protects unused subdomains from spoofing.