# DMARC Record Checker: Free DMARC Lookup and Test

URL: https://email-validation.org/tools/dmarc-checker/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Enter a domain to see its DMARC record, the policy receivers apply to mail that fails, where reports go and whether
the report addresses are authorised. If a subdomain has no record of its own, the checker shows the organizational
domain's record that applies instead. Each problem comes with its fix.

## What DMARC does

DMARC ([RFC 7489](https://www.rfc-editor.org/rfc/rfc7489)) ties SPF and DKIM to the address people see in the From
line. A message passes DMARC when SPF or DKIM passes **and** the domain that passed is aligned with the From domain.
The domain owner publishes a TXT record at `_dmarc.<domain>` that tells receivers what to do with mail that fails
(nothing, spam folder, or reject) and where to send reports about it.

## The tags

| Tag | Meaning |
| --- | --- |
| `v=DMARC1` | Required, and must come first |
| `p=` | Policy for failing mail: `none`, `quarantine` or `reject` (required) |
| `sp=` | Policy for subdomains (defaults to `p=`) |
| `rua=` | Where aggregate reports go (`mailto:` addresses, comma separated) |
| `ruf=` | Where failure reports go (few providers send them) |
| `pct=` | Share of failing mail the policy applies to (default 100) |
| `adkim=`, `aspf=` | Alignment: `r` relaxed (subdomains match, the default) or `s` strict |
| `fo=` | When failure reports are generated |

## The problems this checker finds

- **No record.** Without DMARC, anyone can send mail that shows your domain in the From line, and you get no reports.
  Gmail and Yahoo require DMARC (at least `p=none`) from bulk senders.
- **More than one record.** Receivers then apply none of them
  ([RFC 7489 §6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)).
- **`v=DMARC1` not first, or no valid `p=`.** A record that does not start with `v=DMARC1` is discarded; one without
  a valid policy counts as `p=none` if it has a valid `rua=`, and is ignored otherwise
  ([§6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.3), [§6.6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.6.3)).
- **`p=none`.** Monitoring only: you get reports, but failing mail is delivered. It is the right first step, not the
  last one.
- **`sp=none` under an enforced policy**, which leaves every subdomain open to spoofing.
- **`pct` below 100**, which applies the policy to part of the failing mail only.
- **No `rua=`.** Without aggregate reports you cannot see who sends as your domain, so you cannot safely enforce.
- **Report addresses on another domain that has not authorised them.** A receiver sends reports to another domain
  only if that domain publishes `<your domain>._report._dmarc.<their domain>`
  ([§7.1](https://www.rfc-editor.org/rfc/rfc7489#section-7.1)); report services publish it for their customers.

## From p=none to p=reject

1. Publish `p=none` with a `rua=` address and read the reports for two to four weeks.
2. For every legitimate source in the reports, make SPF or DKIM pass on your domain (DKIM survives forwarding, so it
   matters most).
3. Move to `p=quarantine`, optionally with `pct=` raised in steps, and watch the reports.
4. Move to `p=reject` once nothing legitimate fails.

An enforced policy (quarantine or reject at 100%) is also what [BIMI](https://email-validation.org/tools/bimi-checker/) requires before mail
clients show your logo. Build or change the record with our [DMARC generator](https://email-validation.org/tools/dmarc-generator/).

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/) or see [pricing](https://email-validation.org/pricing/) for lists and the API.

## Frequently asked questions

### Is p=none enough?

It meets the Gmail and Yahoo minimum for bulk senders and gives you reports, but it does not stop anyone from spoofing your domain. Move to p=quarantine and then p=reject once the reports show your own mail passes.

### Why do my DMARC reports not arrive?

Check that the record has a rua= mailto address. If that address is on another domain, the other domain must publish an authorisation record at yourdomain._report._dmarc.theirdomain, or receivers drop the reports.

### Does a subdomain need its own DMARC record?

No. Without its own record, a subdomain uses the record of its organizational domain, with the sp= policy if one is set.