Back to tools

Email tool

DMARC Record Checker

Check a domain's DMARC TXT record and review its policy, reporting, and alignment settings.

DNS query

What DMARC does

DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) is a TXT record published at _dmarc.<domain>. It tells receivers how to treat mail that fails SPF and DKIM, and where to send feedback. Its core addition is identifier alignment: the visible From domain must match the domain validated by SPF or by DKIM. Without alignment, an attacker could pass SPF using their own domain while still forging your From address — which is exactly what DMARC stops.

How to read the results

A record begins with v=DMARC1 followed by semicolon-separated tags, and v= plus p= are the only required ones. The p tag sets the policy — none, quarantine, or reject. sp overrides the policy for subdomains. rua and ruf give addresses for aggregate and forensic reports. pct samples a percentage of messages for enforcement, and adkim/aspf set DKIM/SPF alignment to relaxed (r) or strict (s). Relaxed alignment accepts any subdomain of the organizational domain; strict requires an exact match.

A worked example

Take "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100; adkim=s; aspf=r". Every message (pct=100) that fails alignment is sent to quarantine. DKIM alignment is strict, so the signing d= domain must equal the From domain exactly; SPF alignment is relaxed, so an organizational-domain match (mail.example.com vs example.com) is enough. Aggregate reports flow to [email protected].

Common problems / misconfigurations

These configuration gaps leave a domain reported as 'has DMARC' while offering little real protection:

  • Record not published at the _dmarc label — DMARC is effectively absent.
  • Staying at p=none indefinitely — it monitors but never blocks spoofing.
  • rua pointing to an unmonitored mailbox — reports pile up unseen.
  • An external rua domain with no matching authorization record — RFC 7489 §7.1 requires the receiving domain to publish one.

FAQ

  • Does DMARC require both SPF and DKIM to pass? — No. DMARC passes if either SPF or DKIM passes and is aligned with the From domain.
  • What's the difference between p=quarantine and p=reject? — Quarantine routes failing mail to spam; reject blocks it outright during the SMTP transaction.
  • Why am I getting DMARC reports from many providers? — The rua tag collects aggregate XML from every receiver; that volume is expected and maps out your senders.