🛡️ DMARC Checker: Look Up and Test Any Domain DMARC Record
By Shihab Mia · Updated 2026-07-10
Enter a bare domain. Any https://, www. or trailing path is stripped automatically.
Enter a domain such as google.com and press Check DMARC record to look up and explain its DMARC policy.
A DMARC checker reads the DNS TXT record at _dmarc.yourdomain.com and, in under a second, tells you whether a domain is enforcing (p=reject), quarantining (p=quarantine), monitoring only (p=none), or has no DMARC record at all. Enter any domain and this tool queries public DNS live, finds the entry that starts with v=DMARC1, and breaks down every tag, including the p= policy, sp=, rua=, ruf=, pct= and the adkim/aspf alignment settings, in plain English. If no record exists, it tells you the domain is unprotected and exactly what that exposes you to. Everything runs in your browser over DNS over HTTPS, so there is nothing to install, no account, and no cost.
What is the DMARC Record Checker?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a published policy, stored as a single DNS TXT record, that tells receiving mail servers what to do with email that claims to come from your domain but fails authentication. A DMARC checker simply reads that record so you can confirm it exists, is well formed, and is set to the protection level you intended. Because email was never designed with sender verification built in, anyone can put your domain in the From line of a message. DMARC is the layer that finally lets you state, with authority, which mail is really yours and which should be rejected.
DMARC does not work alone. It sits on top of two older standards, SPF and DKIM. SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature that proves a message was not tampered with in transit and that it came from an authorised system. DMARC adds the missing piece: alignment and enforcement. It checks that the domain shown to the human reader in the From header lines up with the domain that passed SPF or DKIM, and then applies your chosen policy. A DMARC record check is therefore the fastest way to see whether all three pieces are pulling in the same direction.
The heart of every record is the p= tag, the policy. There are exactly three valid values. p=none means monitor only: failing mail is still delivered, but you collect reports about it. p=quarantine means failing mail is treated as suspicious and usually lands in the spam or junk folder. p=reject means failing mail is blocked outright and never reaches the inbox. Most organisations roll out DMARC in that exact order, starting at none to gather data without breaking legitimate mail, then tightening to quarantine and finally reject once they are confident every real sender is properly authenticated. Our DMARC checker highlights which of these three states a domain is currently in, so you never have to parse the raw string yourself.
Reporting is the quiet superpower of DMARC, and it is controlled by two tags. The rua= tag is an email address that receives daily aggregate reports: machine-readable XML summaries showing how much mail passed and failed, and from which sources. The ruf= tag receives forensic, or failure, reports with detail about individual failing messages, although many providers limit these for privacy reasons. Reading these reports is how you discover forgotten senders, misconfigured marketing platforms, and outright spoofing attempts before you move to an enforcing policy. A record with p=none but no rua= address is wasting the main benefit of monitoring, and a good DMARC record checker will surface that gap immediately.
Several finer-grained tags shape behaviour. sp= sets a separate policy for subdomains, which is useful when your main domain is strict but a subdomain is still being brought into line. pct= applies the policy to only a percentage of failing mail, a throttle used during careful rollouts. adkim= and aspf= control alignment strictness for DKIM and SPF: the relaxed default accepts a subdomain (organisational) match, while strict (s) demands an exact domain match. Knowing what each tag does turns a wall of text like v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100; adkim=s into a clear statement of intent, which is exactly what this DMARC checker produces for you.
Finally, it is worth understanding why this matters commercially as well as for security. Since February 2024, Google and Yahoo have required bulk senders (those emailing more than 5,000 messages a day) to publish a valid DMARC record, and Microsoft began enforcing the same expectation for high-volume senders to Outlook and Hotmail in 2025, so a missing or weak policy can now directly hurt deliverability, meaning your legitimate newsletters and transactional emails are more likely to be filtered or rejected. Brand impersonation through spoofed email also damages trust and can trigger costly phishing incidents. Running a quick DMARC record check across your own domains, and the domains of vendors you rely on, is a low effort, high value habit. This tool makes that DMARC lookup instant and free, with no account and no data leaving your browser beyond the public DNS query itself.
When to use it
- Confirming that your own domain has a valid DMARC record published before you trust it to protect your brand.
- Checking whether a domain is set to p=none, quarantine or reject so you know if the policy is actually enforced or only monitoring.
- Verifying that aggregate report addresses (rua) are present so you are receiving the data needed to tighten the policy safely.
- Auditing vendors, partners and acquired domains to see which ones are exposed to email spoofing.
- Meeting the Google, Yahoo and Microsoft bulk-sender requirements by confirming a DMARC record exists before a big send.
- Troubleshooting email deliverability when messages are landing in spam and you suspect missing or misaligned authentication.
- Teaching a team what each DMARC tag means by showing a real record broken down line by line.
How to use the DMARC Record Checker
- Type the domain you want to inspect into the box, for example yourdomain.com. Any https://, www. or path is removed automatically.
- Press Check DMARC record. The tool queries public DNS for the TXT record at _dmarc.yourdomain.com.
- Read the policy badge at the top: it tells you at a glance whether the domain is on reject, quarantine, monitor only, or has no record at all.
- Review the raw record and the tag-by-tag table, which explains p=, sp=, rua=, ruf=, pct=, adkim= and aspf= in plain English.
- Use the Copy record button to grab the exact string for documentation or to compare against a recommended configuration.
- If no record is found, follow the guidance to publish one, starting at p=none with an rua address, then moving to quarantine and reject.
Formula & method
Worked examples
You run a DMARC record check on a domain and get back: v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100; adkim=s; aspf=s
- v=DMARC1 confirms this is a valid DMARC record and the version is correct.
- p=reject means any mail failing DMARC is blocked outright. This is the strongest, fully enforced policy.
- rua=mailto:[email protected] shows aggregate reports are being collected, so the owner can monitor sources.
- pct=100 applies the reject policy to all failing mail, and adkim=s with aspf=s require strict, exact-domain alignment.
Result: A fully protected domain: spoofed mail is rejected, alignment is strict, and reporting is on. Nothing to fix.
A different domain returns: v=DMARC1; p=none; rua=mailto:[email protected]
- v=DMARC1 and a present record are good, so DMARC is at least published.
- p=none means the domain is in monitor only mode. Failing mail is still delivered to inboxes.
- rua is set, so the owner is gathering the reports needed to understand their senders.
- There is no sp=, pct= or alignment override, so defaults apply and subdomains inherit the none policy.
Result: Partially configured: reporting works, but the domain is not yet enforcing. The next step is to move to p=quarantine, then p=reject.
You check a small business domain and the DMARC checker reports no record found at _dmarc.example.com
- No TXT record starting with v=DMARC1 exists for the domain.
- Receiving servers have no DMARC instruction, so spoofed mail is judged only by SPF and DKIM, with no alignment enforcement.
- The owner receives no reports and cannot see who is sending mail using their domain.
- The remedy is to publish a starter record such as v=DMARC1; p=none; rua=mailto:[email protected].
Result: The domain is unprotected and easier to spoof. Publishing even a monitoring record is the recommended first move.
A staged rollout returns: v=DMARC1; p=quarantine; sp=reject; pct=50; rua=mailto:[email protected]; adkim=r; aspf=r
- p=quarantine sends failing mail from the main domain to spam rather than blocking it, a safe middle step.
- sp=reject applies a stricter policy to subdomains, which is smart because attackers often abuse unused subdomains.
- pct=50 means the quarantine policy is applied to only half of failing mail while the owner watches the reports.
- adkim=r and aspf=r use relaxed alignment, so an organisational (subdomain) match is accepted.
Result: A domain mid-rollout: main domain quarantining at 50 percent, subdomains already at reject. Raise pct to 100, then move p to reject.
DMARC tags and what they control
| Tag | Required | Purpose | Common values |
|---|---|---|---|
| v | Yes | Protocol version, must be first | DMARC1 |
| p | Yes | Policy for the main domain | none, quarantine, reject |
| sp | No | Policy for subdomains (defaults to p) | none, quarantine, reject |
| rua | Recommended | Address for aggregate (daily) reports | mailto:[email protected] |
| ruf | No | Address for forensic (failure) reports | mailto:[email protected] |
| pct | No | Percent of failing mail policy applies to | 1 to 100 (default 100) |
| adkim | No | DKIM alignment mode | r (relaxed, default) or s (strict) |
| aspf | No | SPF alignment mode | r (relaxed, default) or s (strict) |
| fo | No | Forensic reporting options | 0, 1, d, s |
| ri | No | Aggregate report interval in seconds | 86400 (default, daily) |
DMARC policy levels and what each one does to failing mail
| Policy (p=) | What happens to failing mail | When to use it |
|---|---|---|
| none | Delivered as normal, but reported | Initial rollout and monitoring |
| quarantine | Sent to spam or junk | After monitoring, as a safe middle step |
| reject | Blocked, never delivered | Full enforcement once all senders align |
How SPF, DKIM and DMARC work together
| Standard | Lives at | What it proves | On its own? |
|---|---|---|---|
| SPF | TXT on the domain | The sending server is authorised | No alignment or enforcement |
| DKIM | TXT at selector._domainkey | The message was signed and not altered | No enforcement of the From domain |
| DMARC | TXT at _dmarc.domain | From domain aligns with SPF or DKIM, plus policy | Needs SPF and/or DKIM to check against |
Common DMARC checker results and what to do next
| Result | What it means | Recommended next step |
|---|---|---|
| No record found | Domain has no DMARC and is easy to spoof | Publish v=DMARC1; p=none with an rua address |
| p=none with rua | Monitoring only, data is being collected | Review reports, then move to p=quarantine |
| p=quarantine | Failing mail is sent to spam | Confirm alignment, then move to p=reject |
| p=reject | Full enforcement, spoofed mail blocked | Keep monitoring rua reports for new senders |
| Two DMARC records | Policy is undefined, DMARC is ignored | Delete the extra so exactly one record remains |
Common mistakes to avoid
- Treating p=none as protection. A record with p=none is monitoring only. It collects reports but still delivers spoofed mail to inboxes. It is a starting point, not a finished setup. Move to quarantine and then reject once your senders are aligned.
- Publishing DMARC without SPF and DKIM. DMARC checks alignment against SPF and DKIM results. If those are missing or broken, even legitimate mail can fail DMARC, so jumping straight to p=reject can block your own newsletters and receipts.
- Forgetting the rua reporting address. Without an rua tag you get no aggregate reports, which means you are flying blind. You cannot safely tighten the policy because you cannot see which sources are passing or failing.
- Putting the record in the wrong place. The DMARC TXT record must live at the _dmarc subdomain (_dmarc.example.com), not on the root domain. A record published at the root will not be found by a DMARC checker or by mail servers.
- Publishing more than one DMARC record. A domain must have exactly one TXT record starting with v=DMARC1 at _dmarc. If two exist, receivers treat the policy as undefined and skip DMARC entirely, silently disabling your protection.
- Leaving pct below 100 permanently. The pct tag is a temporary throttle for careful rollouts. Leaving it at a low value long term means most failing mail escapes your policy, which defeats the purpose of moving to reject.
- Ignoring the subdomain policy. If you do not set sp=, subdomains inherit the main policy, which is often fine. But attackers love unused subdomains. If your main policy is strict, make sure sp= is not accidentally weaker.
Glossary
- DMARC
- Domain-based Message Authentication, Reporting and Conformance. A DNS policy telling receivers how to handle mail that fails authentication.
- SPF
- Sender Policy Framework. A DNS record listing the servers allowed to send email for a domain.
- DKIM
- DomainKeys Identified Mail. A cryptographic signature proving a message was authorised by the domain and not altered in transit.
- Alignment
- The check that the visible From domain matches the domain that passed SPF or DKIM. DMARC requires alignment to pass.
- Policy (p=)
- The action a receiver takes on failing mail: none (monitor), quarantine (spam), or reject (block).
- Aggregate report (rua)
- A daily XML summary of how much mail passed and failed DMARC, sent to the address in the rua tag.
- Forensic report (ruf)
- A detailed report about individual failing messages, sent to the address in the ruf tag when enabled.
- Spoofing
- Forging the From address of an email to make it appear to come from a domain the sender does not control.
Frequently asked questions
What is a DMARC checker?
A DMARC checker is a tool that looks up the DMARC record published in a domain DNS and shows you the policy and settings. This DMARC checker queries the TXT record at _dmarc.yourdomain.com, finds the entry starting with v=DMARC1, and explains every tag so you can see whether the domain is protected.
How do I check a DMARC record for my domain?
Enter your domain in the box above and press Check DMARC record. The tool performs a live DNS lookup and displays the raw record plus a plain-English breakdown. You can also do a manual DMARC record check by querying the TXT records at _dmarc.yourdomain.com with a DNS tool such as dig or nslookup.
What does it mean if no DMARC record is found?
It means the domain is unprotected by DMARC. Receiving mail servers have no instruction for handling mail that fails authentication, so the domain is easier to spoof and you get no reports. The fix is to publish a DMARC record, starting at p=none with an rua reporting address.
What is the difference between p=none, quarantine and reject?
p=none monitors only and still delivers failing mail. p=quarantine sends failing mail to spam. p=reject blocks failing mail entirely. Most domains move through none, then quarantine, then reject as they gain confidence that all legitimate senders are aligned.
Is this DMARC checker free, and is my data safe?
Yes, it is completely free with no account. The DMARC record check runs in your browser using public DNS over HTTPS. The only thing sent is the public DNS query for the domain name you enter, which is the same lookup any mail server performs.
What is a good DMARC record to start with?
A safe starter record is v=DMARC1; p=none; rua=mailto:[email protected]. It publishes DMARC in monitor-only mode and sends aggregate reports to your address so you can see who sends mail as your domain. Once your reports show only legitimate, aligned senders, tighten to p=quarantine and then p=reject.
Why does my DMARC record check show a record but mail still gets spoofed?
If the policy is p=none, the domain is only monitoring, so spoofed mail is still delivered. Spoofing can also slip through if SPF or DKIM are misconfigured so that real and fake mail are not properly distinguished. Tighten to quarantine or reject after confirming alignment in your aggregate reports.
Where should the DMARC record be published?
As a DNS TXT record at the host _dmarc.yourdomain.com. A common mistake is publishing it on the root domain, where neither a DMARC checker nor a mail server will find it. There should be only one DMARC record per domain.
What do rua and ruf mean in a DMARC record?
rua is the address that receives aggregate reports, daily XML summaries of pass and fail volumes by source. ruf is the address for forensic reports about individual failing messages. rua is the more useful and widely supported of the two and is strongly recommended.
Do I need SPF and DKIM before publishing DMARC?
Yes. DMARC checks alignment against SPF and DKIM results, so both should be set up first. If you publish p=reject without working SPF and DKIM, your own legitimate mail can fail DMARC and be blocked. Start with p=none, fix SPF and DKIM, then enforce.
What does adkim and aspf control in the record?
They set alignment strictness. The default relaxed mode (r) accepts a subdomain match between the From domain and the authenticated domain. Strict mode (s) requires an exact match. Strict is more secure but needs all senders to use the exact domain, so it is usually adopted later in a rollout.
Does DMARC affect email deliverability?
Yes. Since February 2024 Google and Yahoo require bulk senders (over 5,000 messages a day) to publish a valid DMARC record, and Microsoft added similar expectations in 2025. A missing or weak DMARC record can send your legitimate newsletters and receipts to spam, so a passing DMARC checker result also helps your inbox placement.
Sources
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) , IETF (2015)
- Email sender guidelines (bulk sender requirements) , Google Workspace Admin Help