DMARC Record Checker

Verify your domain's DMARC policy to protect against email phishing and spoofing.

>_
Enter a domain to check DMARC records
Results will show DMARC policy details and reporting configuration

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM. It tells receiving mail servers what to do when an email fails authentication checks and where to send reports about those failures.

Example

_dmarc.example.com. 300 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

This record instructs receivers to reject emails that fail authentication and send aggregate reports to dmarc@example.com.

DMARC Policy Types

  • p=none — Monitor only. No action is taken on failing emails. Use this to collect data before enforcing a policy.
  • p=quarantine — Failing emails are sent to the spam/junk folder. A good intermediate step before full enforcement.
  • p=reject — Failing emails are rejected outright. The strongest protection against spoofing.

Common DMARC Tags

  • rua — Aggregate report destination (e.g. mailto:reports@example.com)
  • ruf — Forensic report destination
  • pct — Percentage of messages subject to the policy (default 100)
  • sp — Policy for subdomains
  • adkim — DKIM alignment mode (r=relaxed, s=strict)
  • aspf — SPF alignment mode (r=relaxed, s=strict)

What DMARC does and how to read the result

DMARC is a DNS TXT record published at _dmarc.yourdomain.com. It tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM checks, and where to send reports about it. This tool fetches the record from Google Public DNS and explains each tag.

The tags that matter

A safe way to roll it out

  1. Start with p=none and a rua address, and read the reports for a few weeks.
  2. Fix any legitimate sender that is failing SPF or DKIM.
  3. Move to quarantine, then to reject once the reports are clean.

Since February 2024, Google and Yahoo have required senders of bulk email to publish a DMARC record, so it is no longer optional for newsletters and marketing mail. If the result says no record was found, the domain has no DMARC policy at all. Read the DMARC guide for the full setup.