DomainDNSCheck

DMARC Checker

Enter a domain to read its DMARC record and see how receivers are told to handle mail that fails authentication.

  • Email security
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

At a glance

What it checks
Read a domain's DMARC policy, reporting addresses and alignment settings, and see how strictly it is enforced.
Data source
The _dmarc TXT record, with organisational-domain fallback and report-destination authorisation checks.
Freshness
Live check; results are cached for up to 10 minutes
Limits
Shows the published policy; whether receivers apply it, and who sends your mail, cannot be seen from DNS. Methodology
Cost
Free, no account needed

Understanding the result

How DMARC works

Domain-based Message Authentication, Reporting and Conformance (DMARC) ties SPF and DKIM to the From address that recipients actually see. A message passes DMARC when SPF or DKIM passes and the domain it authenticated is aligned with the From domain. The DMARC record, published as TXT at _dmarc.example.com, tells receivers what to do with mail that fails and where to send reports.

v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r

What DMARC does covers alignment and reporting in more depth.

How the record is found

The checker queries _dmarc. followed by the name you enter. When you enter a subdomain that has no record of its own, it also checks the organizational domain, because receivers apply the parent's policy (or its sp= subdomain policy) in that case. The result shows where the record was found and whether it was inherited.

Reading the findings

  • Record present: missing is a FAIL, since without DMARC receivers have no instructions for spoofed mail. More than one DMARC record is also a FAIL, as receivers then ignore both.
  • Policy: p=reject and p=quarantine are a PASS. p=none is a WARNING, because it collects reports but asks receivers to take no action. A missing or invalid p tag is a FAIL.
  • pct: when an enforcing policy applies to less than 100 percent of failing mail, a WARNING shows the percentage.
  • Aggregate reporting: a rua address is a PASS; without it (INFO) you get no visibility into who sends mail as your domain.
  • Alignment: INFO showing whether DKIM and SPF alignment are relaxed (the default, allowing subdomains) or strict (exact domain match).

The record details also list the subdomain policy sp, any forensic report address ruf and every other tag.

Moving to enforcement

A safe rollout usually looks like this:

  1. Publish p=none with a rua address and read the aggregate reports for a few weeks.
  2. Fix every legitimate sender that fails, typically by adding DKIM signing or SPF entries for newsletters, CRMs and ticketing systems.
  3. Move to p=quarantine, optionally with a lower pct at first, then to p=reject.

Aggregate reports are XML files and are easier to read with a DMARC report analyzer. Before tightening the policy, confirm your SPF record with the SPF Checker and your signing keys with the DKIM Checker.

Frequently asked questions

Is p=none useless?

No. It is the right first step, because the reports show which services send mail as your domain. It just does not protect you from spoofing until you move to quarantine or reject.

Can I send DMARC reports to an address on another domain?

Yes, but the receiving domain must publish a TXT record authorizing it, at a name like example.com._report._dmarc.example.net. Report analysis services set this up for you.

Why does DMARC fail when SPF passes?

SPF may be passing for a different domain than the one in the From header, such as the bounce domain of an email service. Without alignment, that pass does not count for DMARC. Setting up DKIM signing with your own domain is usually the fix.

Does DMARC apply to my subdomains?

Yes, unless a subdomain publishes its own record. The sp tag lets you set a different policy for subdomains than for the main domain.