How to Use the DMARC Checker
To check the DMARC record for a domain, enter the domain from your From address and read the result from errors to explanations.
- Enter the domain from the visible From address of your mail, such as example.com.
- Select Check DMARC to look up the TXT record at _dmarc for that exact domain.
- Fix any syntax errors first, then read the policy warnings and the explanation of each tag.
- If no record is found, open the record builder below the tool or use the DMARC Record Generator, then publish the draft in your DNS.
DMARC Record Check
A DMARC record check confirms that the domain publishes exactly one valid record and shows what each of its tags asks receivers to do.
DMARC Lookup for a Domain
The tool reads the TXT record at _dmarc followed by the domain you enter and accepts only records that begin with v=DMARC1. More than one DMARC record at the same name is reported as an error, because receivers then ignore the policy. A subdomain without its own record is checked as entered, so organizational policy inherited from a parent domain is not shown.
Check DMARC Policy
The p tag asks receivers to monitor (none), divert to spam (quarantine) or refuse (reject) mail that fails DMARC. The sp and np tags set separate policies for subdomains and for subdomains that do not exist. A missing p tag is reported, because the record then behaves like monitoring only.
Check DMARC Settings
Each remaining tag is listed with a plain explanation, including adkim and aspf for strict or relaxed alignment and fo for failure reporting options. Report addresses in rua and ruf must be mailto URIs. When they point to another domain, the tool checks that the domain publishes the authorization record that lets it receive your reports.
DMARC Quarantine vs Reject
Quarantine asks receivers to treat failing mail as suspicious, usually by filing it as spam, while reject asks them to refuse it during delivery.
| Policy | What receivers are asked to do | When to use it |
|---|---|---|
| p=none | Deliver as usual and send reports | First stage, while you identify every legitimate sender |
| p=quarantine | Treat failing mail as suspicious, often the spam folder | After reports show that legitimate mail passes |
| p=reject | Refuse failing mail during the SMTP transaction | When reports have been clean for some time and spoofing must stop |
Frequently Asked Questions
Does DMARC Check DKIM?
Yes. DMARC passes when DKIM passes with a signing domain that aligns with the From domain, or when SPF passes with an aligned envelope domain. This checker reads the policy only, so use the DKIM Checker to look up your signing keys.
Can DMARC Work Without DKIM?
It can, because an aligned SPF pass is enough. SPF breaks when mail is forwarded, though, so a DMARC policy without DKIM signing fails more legitimate messages.
Can DMARC Prevent Spoofing?
A quarantine or reject policy stops other people from sending mail that uses your exact domain in the From address, at receivers that apply DMARC. It does not stop look-alike domains or a fake display name.
How Often Are DMARC Reports Sent?
Most receivers send aggregate reports once a day to the rua addresses in your record. Failure reports in ruf are optional, and many large mailbox providers do not send them.
Is DMARC Free?
Publishing a DMARC record is free, since it is a single TXT record in your DNS. Paid services only help to collect and read the reports.
Related Email Tools
Continue with the guide What Is DMARC. Policies, alignment and reports explained.