DMARC Checker: Read a DMARC Record in Plain English
A DMARC record is one line of text that decides what happens to mail pretending to be you. Enter a domain to fetch it, see each tag explained, and find out whether the policy actually protects the domain or just watches.
What DMARC adds on top of SPF and DKIM
A DMARC policy sits in a TXT record at _dmarc.yourdomain.com. When a message arrives claiming to be from your domain, the receiver checks SPF and DKIM. DMARC passes if at least one of them passes and its domain lines up with the From address the reader sees. If neither does, the receiver applies your policy.
That last part, alignment, is why DMARC is more than SPF and DKIM stapled together. It stops an attacker from passing SPF with their own domain while showing yours in the From line.
The three policies, and when to move up
| Policy | What receivers do with failing mail | When to use it |
|---|---|---|
| p=none | Deliver it as usual and send you reports | The starting point: you watch and learn |
| p=quarantine | Treat it as suspicious, usually the spam folder | Once reports show your real mail passes |
| p=reject | Refuse the message | The goal for domains that send mail reliably |
Every DMARC tag in plain English
| Tag | Meaning |
|---|---|
| v=DMARC1 | The version. It must come first |
| p | Policy for the domain: none, quarantine or reject |
| sp | Policy for subdomains. Without it, subdomains follow p |
| pct | The percentage of failing mail the policy applies to |
| rua | Where to send daily aggregate reports, as mailto: addresses |
| ruf | Where to send individual failure reports. Few receivers send them |
| adkim and aspf | Alignment mode for DKIM and SPF: r (relaxed, the default) or s (strict) |
| fo | Which failures should trigger failure reports |
Rolling DMARC out without losing real mail
- Publish v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. Nothing changes for delivery, and reports start arriving.
- Read the reports for a few weeks. They list every source that sends mail as your domain and whether it passed. A DMARC reporting service can turn the XML into something readable.
- Fix every legitimate sender that fails by adding it to SPF or turning on DKIM signing for it.
- Move to p=quarantine, optionally with pct=25 and then higher while you watch for problems.
- Move to p=reject when the reports show that only unauthorised mail fails.
Frequently asked questions
Related tools
SPF Record CheckerValidate an SPF record, count its DNS lookups against the limit of 10 and see what to fix.Open tool DKIM Record LookupFetch a DKIM public key by selector and check its format and strength.Open tool TXT Record LookupView SPF, DKIM, DMARC and verification text records, labelled by type.Open tool MX LookupSee which mail servers receive email for a domain, in priority order.Open tool