DMARC record checker
Example result for example.com
v=DMARC1; p=nonep=none: monitoring only.
Receivers send you reports but do nothing with mail that fails, so your domain can still be spoofed. It meets the Gmail and Yahoo minimum for bulk senders, and it is the right first step.
Fix: Read the reports for a few weeks; when your own mail passes, move to p=quarantine, then p=reject.
No rua= address: you get no reports.
Aggregate reports show who sends mail as your domain and whether it passes. Without them you cannot safely move to quarantine or reject.
Fix: Add rua=mailto:dmarc-reports@example.com (any mailbox you read, or a DMARC report service).
Enter a domain to see its DMARC record, the policy receivers apply to mail that fails, where reports go and whether the report addresses are authorised. If a subdomain has no record of its own, the checker shows the organizational domain's record that applies instead. Each problem comes with its fix.
What DMARC does
DMARC (RFC 7489) ties SPF and DKIM to the address people see in the From line. A message passes DMARC when SPF or DKIM passes and the domain that passed is aligned with the From domain. The domain owner publishes a TXT record at _dmarc.<domain> that tells receivers what to do with mail that fails (nothing, spam folder, or reject) and where to send reports about it.
The tags
| Tag | Meaning |
|---|---|
v=DMARC1 | Required, and must come first |
p= | Policy for failing mail: none, quarantine or reject (required) |
sp= | Policy for subdomains (defaults to p=) |
rua= | Where aggregate reports go (mailto: addresses, comma separated) |
ruf= | Where failure reports go (few providers send them) |
pct= | Share of failing mail the policy applies to (default 100) |
adkim=, aspf= | Alignment: r relaxed (subdomains match, the default) or s strict |
fo= | When failure reports are generated |
The problems this checker finds
- No record. Without DMARC, anyone can send mail that shows your domain in the From line, and you get no reports. Gmail and Yahoo require DMARC (at least
p=none) from bulk senders. - More than one record. Receivers then apply none of them (RFC 7489 §6.6.3).
v=DMARC1not first, or no validp=. A record that does not start withv=DMARC1is discarded; one without a valid policy counts asp=noneif it has a validrua=, and is ignored otherwise (§6.3, §6.6.3).p=none. Monitoring only: you get reports, but failing mail is delivered. It is the right first step, not the last one.sp=noneunder an enforced policy, which leaves every subdomain open to spoofing.pctbelow 100, which applies the policy to part of the failing mail only.- No
rua=. Without aggregate reports you cannot see who sends as your domain, so you cannot safely enforce. - Report addresses on another domain that has not authorised them. A receiver sends reports to another domain only if that domain publishes
<your domain>._report._dmarc.<their domain>(§7.1); report services publish it for their customers.
From p=none to p=reject
- Publish
p=nonewith arua=address and read the reports for two to four weeks. - For every legitimate source in the reports, make SPF or DKIM pass on your domain (DKIM survives forwarding, so it matters most).
- Move to
p=quarantine, optionally withpct=raised in steps, and watch the reports. - Move to
p=rejectonce nothing legitimate fails.
An enforced policy (quarantine or reject at 100%) is also what BIMI requires before mail clients show your logo. Build or change the record with our DMARC generator.
Checking email addresses rather than domains? Try our free email checker or see pricing for lists and the API.