DMARC Checker
Check a domain's DMARC record at _dmarc and see what each tag does: policy, subdomain policy, pct, report addresses and alignment, with recommendations. Enter a domain such as example.com.
- Free
- No signup required
- Live DNS lookup
Common DMARC problems
No DMARC record found
The record must be a TXT record at _dmarc.example.com, not on the domain itself. Check that your DNS panel did not save it as _dmarc.example.com.example.com, and that it starts with v=DMARC1.
Policy left at p=none
p=none collects reports but does not protect you: spoofed mail is still delivered. Once reports show your real senders passing, move to p=quarantine, then p=reject.
No rua address, so no reports
Without rua you get no aggregate reports and cannot see who sends mail as your domain. Add rua=mailto: with a mailbox or a DMARC reporting service you can read.
Reports to another domain are not delivered
If rua points to a mailbox on a different domain, that domain must publish an authorisation record (for example example.com._report._dmarc.reports.net). Reporting services set this up for you; your own second domain needs it added by hand.
Legitimate mail fails after moving to reject
A sender that passes SPF or DKIM for its own domain but not yours fails alignment. Set up custom-domain DKIM in that service or a custom return path before tightening the policy.
Syntax errors in the record
Tags are separated by semicolons and v=DMARC1 must come first. A typo such as p=quarantined or a missing mailto: makes receivers ignore the tag or the whole record.
How to check a DMARC record
- Enter the domain in your From address, for example example.com.
- Click Check DMARC.
- Review the policy, report addresses and alignment settings.
- Follow the recommendations, then check again after the record's TTL.
What is a DMARC record?
DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a TXT record at _dmarc.<domain>. It tells receiving servers what to do with mail that claims to come from your domain but fails authentication, and where to send reports about it.
A message passes DMARC when SPF or DKIM passes and the domain it passed for aligns with the domain in the From line. With relaxed alignment (the default) a subdomain counts, so bounce.example.com aligns with example.com. With strict alignment (adkim=s or aspf=s) the domains must match exactly.
The policy p= decides what happens to failing mail: none (deliver and report), quarantine (send to spam) or reject (refuse it). sp= sets a different policy for subdomains and pct= applies the policy to a percentage of failing mail, which helps you roll out gradually. rua= receives daily aggregate reports, and ruf= receives failure reports, which many receivers do not send.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; adkim=r; aspf=r"
When to use a DMARC checker
Meeting Gmail and Yahoo sender requirements
Bulk senders to Gmail and Yahoo need a DMARC record. p=none is enough to meet the requirement, but check that the record exists and parses correctly.
Rolling out DMARC on Google Workspace or Microsoft 365
Start with p=none and rua reports, confirm your mailbox provider and every sending tool pass, then raise the policy step by step and check the record after each change.
Someone is spoofing your domain
If customers receive phishing mail from your address, check whether your policy is still none. quarantine or reject tells receivers to stop delivering it.
Reviewing a client or vendor domain
Before trusting invoices or payment requests from a domain, see whether it publishes a DMARC policy that protects against spoofing.
Check something else
- SPF CheckerValidate a domain's SPF record, count its DNS lookups against the limit of 10 and check the all qualifier.
- Email Health CheckScore a domain's email setup: MX, SPF, DMARC, DKIM and MTA-STS, with the issues to fix first.
- TXT Record LookupSee every TXT record on a name, with SPF, DMARC, DKIM and domain verification tokens recognised.
- MX LookupFind the mail servers for a domain, in priority order, with TTLs and each server's IP addresses.
Frequently asked questions
Which DMARC policy should I use?
Start with p=none and a rua address so you get reports without affecting delivery. When the reports show all your legitimate senders passing, move to p=quarantine, then p=reject. Reject gives the strongest protection against spoofing.
Where do I add the DMARC record?
As a TXT record on the name _dmarc under your domain. In most DNS panels you enter _dmarc as the name and the panel appends your domain. The value starts with v=DMARC1.
Does DMARC need both SPF and DKIM?
One aligned pass is enough. In practice set up both: SPF can break when mail is forwarded, and DKIM signatures usually survive forwarding.
What is the difference between rua and ruf?
rua receives aggregate reports: daily XML summaries of which IPs sent mail as your domain and whether they passed. ruf receives failure reports about individual messages. Many large receivers do not send ruf reports, so rua is the one to rely on.
Does the policy apply to subdomains?
Yes, the organisational domain's policy applies to subdomains that have no DMARC record of their own, unless you set sp= to a different policy. A subdomain can also publish its own _dmarc record.
What does pct do?
pct sets the percentage of failing messages the policy applies to; the rest are handled one step down (quarantine instead of reject, none instead of quarantine). It is useful for a gradual rollout. Leave it at 100, or out, once you are confident.
Stop finding outages from customer emails
TinyPing does not monitor DMARC or other DNS records, so recheck them here after changes. It does check your site every 5 minutes and alerts you when:
- the website returns an error or times out
- the domain stops resolving
- a mail server port you run stops accepting connections
US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.
Want alerts in team chat? Follow the guide for Slack or Google Chat.