DMARC Checker

Check a domain's DMARC policy, alignment settings, and reporting configuration.

What is a DMARC checker?

A DMARC checker reads a domain's DMARC record and explains what it tells receiving mail servers to do. DMARC, Domain-based Message Authentication, Reporting and Conformance, builds on SPF and DKIM. It sets a policy for messages that fail those checks, decides how strictly the domains must match, and asks receivers to send you reports about mail using your domain.

This tool shows every setting in plain language, flags problems and suggests the next step.

How DMARC works

A DMARC record is a TXT record at _dmarc.example.com. When a message arrives, the receiver checks SPF and DKIM and whether the domain that passed matches the domain in the visible From address, which is called alignment. If neither passes with alignment, the receiver applies your policy:

  • p=none: monitor only; deliver as normal and send reports.
  • p=quarantine: treat failing mail as suspicious, usually sending it to spam.
  • p=reject: refuse failing mail outright.

How to check your DMARC record

  1. Enter your domain, for example example.com.
  2. Press Check DMARC.
  3. Read the policy, subdomain policy and percentage.
  4. Review the problems and recommendations below the table.

What the DMARC results mean

Policy and subdomain policy

The policy (p=) applies to the domain itself. The subdomain policy (sp=) applies to subdomains and copies the main policy when it is not set.

Percentage

pct= sets the share of failing mail that the policy applies to. The rest is handled as if the policy were none. It defaults to 100.

Alignment

DKIM and SPF alignment can be relaxed, where a subdomain counts as a match, or strict, where the domains must be identical. Relaxed is the default and suits most senders, including those that send from subdomains such as mail.example.com or through services that use their own subdomain of yours.

Reports

rua addresses receive daily aggregate reports summarising who sent mail as your domain. ruf addresses receive failure reports, which few providers send. The fo tag sets when failure reports are produced.

An example DMARC record

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r

This asks receivers to send failing mail to spam, uses relaxed alignment for both checks and sends daily aggregate reports to the address given. The reports arrive as compressed XML files, so most people use a DMARC reporting service to turn them into readable charts.

Moving from monitoring to protection

Start with p=none and a rua address, then read the reports for a few weeks to find every service that sends your mail. Fix SPF and DKIM for each one. Next, move to p=quarantine, optionally with a lower pct at first, and finally to p=reject. Only a quarantine or reject policy actually stops spoofed mail.

Common uses

  • Checking DMARC before moving to a stricter policy.
  • Meeting the DMARC requirements of large mailbox providers for bulk senders.
  • Confirming where DMARC reports are being sent.
  • Checking that a domain which never sends email uses p=reject.

Common problems and fixes

No DMARC record. Add a TXT record at _dmarc such as v=DMARC1; p=none; rua=mailto:dmarc@example.com.

Missing or unrecognised p= tag. The policy is required and must be none, quarantine or reject.

Reports go to another domain. When rua points to an address at a different domain, that domain must publish a record agreeing to receive your reports. DMARC reporting services set this up for you.

Stuck on p=none. Monitoring alone does not protect the domain. Use the reports to fix senders, then increase the policy.

Related tools

Frequently asked questions

What does a DMARC record do?

A DMARC record tells receiving mail servers what to do with messages that claim to come from your domain but fail SPF and DKIM alignment, and where to send reports about them. It turns SPF and DKIM into real protection against spoofed email that uses your domain in the From address.

Which DMARC policy should I use?

Start with p=none and a reporting address so you can see who sends mail as your domain without affecting delivery. Once every genuine sender passes, move to p=quarantine and then to p=reject. Only quarantine and reject actually stop spoofed messages from reaching inboxes.

What is DMARC alignment?

Alignment means the domain that passed SPF or DKIM matches the domain in the visible From address. Relaxed alignment, the default, accepts a subdomain, while strict alignment requires an exact match. A message passes DMARC when SPF or DKIM passes and is aligned.

What is the difference between rua and ruf?

The rua tag lists addresses for aggregate reports: daily summaries of how much mail used your domain and whether it passed. The ruf tag lists addresses for failure reports about individual messages. Aggregate reports are the useful ones, and many providers no longer send failure reports.

Do I need DMARC if I already have SPF and DKIM?

Yes. SPF and DKIM on their own do not tell receivers what to do when checks fail, and they do not protect the From address people actually see. DMARC adds that policy and the reports. Large mailbox providers now expect DMARC from domains that send in bulk.

What does pct= mean in a DMARC record?

The pct tag sets the percentage of failing messages that the policy applies to, from 0 to 100. The rest are handled as if the policy were none. It is useful for moving to quarantine or reject gradually, and should end at 100, the default.

Does DMARC stop all phishing emails?

No. DMARC stops other people from using your exact domain in the From address. It cannot stop lookalike domains, such as one letter changed, or display names that imitate you. Monitoring for lookalike domains and training staff are still important.