Free tool · DMARC record check
DMARC Record Checker
Look up a domain’s DMARC record, see which policy actually applies, and check report addresses — following the current DMARC standard, RFC 9989.
What a DMARC record is
DMARC tells receiving servers what to do with mail that claims to come from your domain but fails authentication, and asks them to send you reports. A message passes DMARC when SPF or DKIM passes for a domain that matches the From address the reader sees — that matching is called alignment.
The record is a TXT record at _dmarc on your domain:
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"DMARC is defined by RFC 9989, published in May 2026. It replaces RFC 7489, the version most older guides describe.
DMARC tags
| Tag | Meaning | Default |
|---|---|---|
v=DMARC1 | Must be the first tag, spelled exactly like this, or the record is ignored. | — |
p= | Policy for the domain: none, quarantine or reject. | none if missing |
sp= | Policy for subdomains. | Same as p |
np= | Policy for subdomains that don’t exist. | Same as sp |
t=y | Test mode: receivers apply one level less than your policy. | n |
rua= | Where to send daily aggregate reports, as mailto: addresses. | No reports |
ruf= | Where to send failure reports. Not every receiver sends them. | None |
adkim=, aspf= | Alignment: r (relaxed, subdomains count) or s (strict, exact match). | r |
pct is gone. RFC 9989 removed the percentage tag and added t=y for testing instead. Receivers that still follow the older standard may read pct, so the checker reports it, but new records shouldn’t use it.
From p=none to p=reject
- Start with
p=noneand a report address. Nothing changes for your mail, and the reports show every service sending as your domain and whether it passes. - Fix what fails. Add missing services to SPF and turn on DKIM for each of them.
- Move to
p=quarantinewhen reports show your own mail passing. Failing mail goes to spam. - Finish with
p=reject. Forged mail is refused outright.
p=none meets Gmail’s and Yahoo’s requirement for bulk senders, but it doesn’t protect your domain from spoofing; only quarantine and reject do.
Subdomains and report addresses
A subdomain without its own DMARC record falls under its parent’s: receivers walk up the DNS tree to the organisational domain and apply its sp= policy, or p= if there is none. This checker does the same walk and tells you where the policy came from.
Reports sent to an address at another domain — usually a DMARC reporting service — are only delivered if that domain publishes a record authorising them, at yourdomain._report._dmarc.theirdomain. The checker looks for it and warns you if it’s missing, since reports would otherwise quietly go nowhere.
Questions
What is the best DMARC policy?
p=reject gives the most protection, but only once all your real mail passes SPF or DKIM with alignment. Get there in steps: none, then quarantine, then reject, checking reports at each stage.
Do I need DMARC if I don’t send bulk email?
Gmail and Yahoo only require it from bulk senders, but without DMARC anyone can send mail that appears to come from your domain. A domain that sends no mail at all should publish p=reject.
Why aren’t my DMARC reports arriving?
Check that rua uses the mailto: format, that the mailbox exists, and — if it’s at another domain — that the domain publishes the authorisation record. Reports typically cover one day and arrive the day after.
Can I have two DMARC records?
No. With more than one record at _dmarc, receivers ignore DMARC for the domain. Combine everything into one record.
What happened to pct=?
RFC 9989 removed it. Use t=y to test a stricter policy instead: receivers then apply one level less — quarantine is treated like none, and reject like quarantine.
Sources
More free tools
Check something else
Setup guides