DMARC checker
Look up a domain's DMARC record, see which policy applies to its mail, and build the next record to publish.
A DMARC checker reads the TXT record at _dmarc.yourdomain.com and tells you which policy receivers apply to mail that fails: none, quarantine or reject. If your domain has no record, receivers look for one higher up the DNS tree (RFC 9989, section 4.10.1). Gmail, Yahoo and Outlook.com accept p=none from bulk senders, but only quarantine and reject ask receivers to act on failing mail.
Last verified . The sources named on this page were read that day.
DMARC checker, the tool
Sample report. kestrel-labs.example is a made-up domain
Warning
DMARC is at p=none, which makes no request about failing mail. Once reports show all your senders pass, move to quarantine.
Looked up _dmarc.kestrel-labs.example (TXT)
Record as published
v=DMARC1; p=none; rua=mailto:dmarc@kestrel-labs.example
What each part means
Where reports go
mailto:dmarc@kestrel-labs.exampleSame organization, no authorization needed.
Record to publish
- Host
_dmarc.kestrel-labs.example- Type
TXT- Value
v=DMARC1; p=quarantine; rua=mailto:dmarc@kestrel-labs.example
Publish this only after the reports show every service that sends as you passing SPF or DKIM in alignment.
The rest of the report
- SPFFailSPF needs 11 DNS lookups and the limit is 10, so receivers return a permanent error and SPF fails.
- DKIMWarningDKIM key found at google: 1024-bit RSA key. RFC 8301 says signers should use at least 2048 bits.
- MXPass1 MX host, and it resolves. Mail is hosted by Google Workspace.
- BIMINot foundNo BIMI record. BIMI is optional, and it needs DMARC at quarantine or reject before any inbox shows a logo.
- MTA-STSNot foundNo MTA-STS record. It is optional; it tells senders to refuse delivery without verified TLS to your listed MX hosts.
- BlocklistsCould not checkNot listed on the 14 queries that answered. Spamhaus DBL could not be checked from our server.
The three domains DMARC compares
SPF and DKIM each pass for a domain of their own. In the default relaxed mode, DMARC passes when either of those domains shares an organizational domain with the From address, the one the reader sees.
Sent with the service's own domains
- From, the address the reader sees
hello@example.com- Envelope sender, checked by SPF
bounce-41c2d7@bounces.esp.example.netPasses. Not aligned- DKIM signing domain, d=
esp.example.netPasses. Not aligned
DMARC fails
Your domain set up at the service
- From, the address the reader sees
hello@example.com- Envelope sender, checked by SPF
bounce-41c2d7@mail.example.comPasses. Aligned in relaxed mode- DKIM signing domain, d=
example.comPasses. Aligned
DMARC passes
The policy ladder, from none to reject
p=noneReceivers are asked for nothing. Read the reports and list every source that fails; RFC 9989 calls this monitoring mode.
p=quarantineFailing mail is treated as suspicious, which Google’s guide describes as the spam folder. Watch for a billing system or support desk that still fails.
p=rejectFailing mail is refused. Domains whose people post to mailing lists should not publish it, and RFC 9989 suggests those that do spend a month at none and as long at quarantine first (section 7.4).
DMARC tags
| Tag | Values | What it does |
|---|---|---|
v | DMARC1 | Required, and first |
p, sp, np | none, quarantine, reject | Policy for the domain, its subdomains, and subdomains that do not exist |
rua, ruf | mailto: addresses | Where aggregate and failure reports go. Gmail sends no failure reports |
adkim, aspf | r (default), s | Relaxed or strict alignment |
t | n (default), y | t=y asks receivers not to apply the policy, for testing |
fo | 0 (default), 1, d, s | When to send failure reports |
psd | y, n, u (default) | For public suffix operators only |
pct, rf, ri | Removed | Ignored by receivers that follow RFC 9989 |
Source: RFC 9989, section 4.7. It dropped pct because it was usually not accurately applied.
DMARC record builder
Choose the policy and where reports go. The record updates as you type.
There is no pct: RFC 9989 removed it, and newer receivers ignore it. t=y is its replacement for testing.
- Host
_dmarc.yourdomain.com- Type
TXT- Value
v=DMARC1; p=none
- Without a rua address you get no reports, so you cannot see what sends as your domain.
The checker finds your record the way receivers do: at _dmarc on the From domain, then up the tree, and it discards a name that holds two records (RFC 9989, section 4.10). A report address on another domain needs that domain’s consent record (RFC 9990), which the checker looks up.
Related tools
- SPF record checkerCheck a domain's SPF record and count its DNS lookups through every include against the limit of 10.
- DKIM checkerFind a domain's DKIM keys at common selectors or your own, and read each key's type and length.
- Email domain checkerCheck a domain's SPF, DKIM, DMARC, MX, BIMI, MTA-STS and blocklist status, with the record to publish for each problem.