DMARC checker and record lookup
Enter a domain and the DMARC checker finds its _dmarc record, explains each tag in plain English, grades the policy and flags anything that weakens your protection or your inbox placement.
- Every tag explained
- Policy graded
- Problems flagged with fixes
What a DMARC record check looks at
DMARC sits on top of SPF and DKIM. It tells receivers what to do with mail that fails both, and where to send reports about it.
The record lives at _dmarc.yourdomain.com. A DMARC lookup reads that TXT record and checks the policy, the reporting addresses and the alignment settings.
- Is there exactly one record?
- Is the policy enforcing or only monitoring?
- Are reports going somewhere you read?
- Do subdomains have their own policy?
DMARC record tags explained
| Tag | Meaning | Typical value |
|---|---|---|
| p | Policy for the domain: none, quarantine or reject. | quarantine or reject |
| sp | Policy for subdomains. Falls back to p if missing. | reject |
| pct | Share of failing mail the policy applies to. | 100 |
| rua | Address for daily aggregate reports. | mailto:dmarc@yourdomain.com |
| ruf | Address for failure reports. Many providers no longer send these. | Optional |
| adkim / aspf | Alignment mode for DKIM and SPF: r (relaxed) or s (strict). | r |
| fo | When to send failure reports. | 1 |
Problems the DMARC checker flags
No DMARC record
Gmail and Yahoo have required a DMARC record from bulk senders since February 2024. Without one, your mail is easier to spoof and more likely to be filtered.
Policy stuck at p=none
p=none only monitors. It is the right place to start, but leaving it there for months means spoofed mail is still delivered.
Multiple DMARC records
Two records at _dmarc make the policy invalid. Receivers act as if you have none.
Missing rua address
Without aggregate reports you cannot see who sends as your domain, so you cannot safely tighten the policy.
Moving from p=none to p=reject safely
- 1
Start at p=none with rua
Collect reports for two to four weeks and list every service that sends as your domain.
- 2
Fix SPF and DKIM for each sender
Make sure every legitimate source passes and aligns. Use the SPF and DKIM checkers to confirm.
- 3
Move to quarantine
Set p=quarantine, optionally with pct below 100 at first, and keep reading reports.
- 4
Finish at reject
Once reports show only spoofed mail failing, set p=reject.
It looks up the TXT record at _dmarc.yourdomain.com, reads each tag, and tells you whether the policy protects your domain. This one also grades the policy and lists problems with suggested fixes.
It meets the Gmail and Yahoo requirement for having a DMARC record, but it does not stop spoofing. Use p=none to collect reports, then move to quarantine and reject.
The record may be missing, published at the wrong host, or not yet propagated. It must be a TXT record at _dmarc, not at the root domain. Check again an hour after publishing.
A strict policy can block your own mail if a legitimate sender fails SPF and DKIM. That is why you read reports at p=none first and fix every sender before you enforce.
Use the DMARC record generator to pick a policy and reporting address, then publish the result as a TXT record at _dmarc.yourdomain.com. Run the DMARC record check again to confirm.
Further reading
- RFC 7489: DMARC The DMARC specification, covering policies, alignment and reports.
- Google Postmaster Tools Free Gmail data on your domain reputation and spam rate.
- Yahoo sender best practices What Yahoo Mail expects from bulk and cold email senders.
Want someone to take you from p=none to p=reject?
We read your DMARC reports, fix every sender and move your policy to enforcement without losing legitimate mail.