DMARC Record Checker
Read a domain's DMARC policy, check every tag, and confirm that report addresses are set up correctly.
How it works
DMARC tells receiving servers what to do with mail that claims to come from your domain but fails SPF and DKIM alignment, and where to send reports about it. The record is a TXT record at _dmarc.yourdomain.com.
This tool fetches that record (and, if a subdomain has none, the parent domain's), validates each tag, and for report addresses on other domains checks that they have published the permission record receivers require.
| Policy | What receivers are asked to do |
|---|---|
p=none | Deliver as normal, just send reports. Start here. |
p=quarantine | Treat failing mail as suspicious, usually spam folder. |
p=reject | Refuse failing mail. The goal. |
| Tag | Purpose |
|---|---|
rua | Where daily aggregate reports go. |
sp | Policy for subdomains, if different. |
pct | Percentage of failing mail the policy applies to. |
adkim, aspf | Relaxed (r) or strict (s) matching of the From domain. |
To write a new record, use the DMARC Record Generator.
Frequently asked
Do I need DMARC?
If you send email from a domain, yes. It stops others spoofing your From address, and Google and Yahoo require it from anyone sending in bulk. Even p=none with reports is a useful start.
How do I move from none to reject safely?
Publish p=none with a rua address, read the reports for a few weeks to find every service that sends as your domain, fix any that fail, then step up to quarantine (you can use pct to apply it gradually) and finally reject.
Why am I not getting DMARC reports?
Common causes: no rua tag, a typo in the address, a report address on another domain that has not published the authorisation record, or the mailbox rejecting large XML attachments. Reports are sent about once a day by each large receiver.
What is the difference between p and sp?
p is the policy for the domain itself and, unless sp is set, for its subdomains too. Set sp when subdomains need a different policy, for example a stricter one if they send no mail.
Is DMARC enough on its own?
It builds on SPF and DKIM: a message passes DMARC only if SPF or DKIM passes and the passing domain matches the visible From domain. You still need at least one of them set up properly.