Free tool · No sign-up

DMARC record checker

Updated 2 November 2026

Enter a domain to look up its DMARC record, read the policy (none, quarantine or reject), reporting addresses, subdomain policy and alignment, and get a plain-English next step. If there's no record, you get a safe starter record to copy.

What DMARC does

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It tells receiving mail servers what to do when a message claims to be from your domain but fails both SPF and DKIM alignment, and where to send reports about it. It's the piece that actually protects the From: address your customers see, and since 2024 Gmail and Yahoo require a DMARC record from anyone sending in bulk.

Reading a DMARC record

p=none: monitor only. Failing mail is still delivered, but you receive reports.
p=quarantine: failing mail goes to spam.
p=reject: failing mail is refused. This is the goal.
rua=mailto:…: where receivers send daily aggregate reports. Without it you're flying blind.
sp=: a separate policy for subdomains. If it's missing, subdomains follow p=.
pct=: the share of failing mail the policy applies to, 100 by default.
adkim and aspf: relaxed (r, the default) or strict (s) alignment. Relaxed suits most domains.

A safe path to p=reject

Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
Read the reports for two to four weeks. They list every service sending as your domain. Fix SPF (see the SPF checker) and turn on DKIM signing for each legitimate one: your mailbox provider, newsletter tool, CRM, invoicing app.
Move to p=quarantine, optionally with a lower pct at first.
When reports stay clean, move to p=reject.

Aggregate reports are XML files. Free report viewers from several email-security companies turn them into readable tables. If the rua address is on another domain, that domain must publish a small authorisation record, or receivers won't send the reports.

How this checker finds the record

It looks up _dmarc on the exact domain you enter. If that has none, it checks the organisational domain (for example example.com for mail.example.com), because subdomains inherit the parent's policy. It also checks for an SPF record, since DMARC needs SPF or DKIM to pass.

Frequently asked questions

Is p=none enough?

It's the right first step, but it doesn't stop spoofed mail being delivered. Move to quarantine and then reject once reports show your real senders pass.

Do I need DMARC if I only send a few emails?

Yes. It's free, protects your brand from phishing, and big mailbox providers increasingly expect it from every sender.

Can I have more than one DMARC record?

No. With more than one record at _dmarc, receivers ignore DMARC entirely. Keep one.

Why don't I receive DMARC reports?

Check the rua address is a mailto: URI, the mailbox exists, and, if it's on another domain, that domain publishes the external-reporting authorisation record.