DMARC Checker

Check your DMARC record and policy, see what every tag means, and confirm your report addresses are authorised to receive reports.

Enter the domain in your "From" address. The record is read from _dmarc.example.com.

What this DMARC checker tests

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with email that claims to be from your domain but fails authentication. This DMARC checker reads the record at _dmarc.yourdomain.com and:

  • Confirms there is exactly one valid record. With two or more, receivers ignore DMARC completely.
  • Explains your policy (p=) and subdomain policy (sp=) in plain English.
  • Validates every tag, including pct, alignment modes and report addresses, and lists defaults for the tags you didn't set.
  • Checks external report authorisation. If reports go to another company's domain, that domain must publish a record allowing it (RFC 7489 §7.1). Otherwise receivers silently drop the reports.
  • Falls back to the organisational domain for subdomains without their own record, exactly as receivers do.

The three DMARC policies

PolicyEffect on failing mailWhen to use it
p=noneDelivered normally; reports onlyThe first few weeks, while you find all your legitimate senders
p=quarantineSent to spam or junkOnce reports show legitimate mail passes
p=rejectRefused outrightThe goal: full protection against spoofing

How DMARC decides pass or fail

A message passes DMARC if either SPF or DKIM passes and the domain it checked lines up ("aligns") with the domain in the visible From address. With relaxed alignment (the default), mail.example.com aligns with example.com. Strict alignment (adkim=s or aspf=s) requires an exact match. Most problems come from third-party services that send as your domain without a DKIM key for your domain. Set up DKIM for each service, then check it with the DKIM Checker.

A safe path to p=reject

  1. Publish v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com.
  2. Read the aggregate reports for 2–4 weeks. Every service that sends as your domain will show up. Fix SPF and DKIM for each one.
  3. Move to p=quarantine, optionally with pct=25 at first, then raise it to 100.
  4. Move to p=reject when reports show no legitimate failures.

Since 2024, Google and Yahoo require DMARC (at least p=none) for anyone sending over 5,000 messages a day to their users, and Microsoft introduced similar rules in 2025. Even small senders see better inbox placement with a working DMARC record.

Frequently asked questions

Where should DMARC reports go?

To a mailbox you control, or a DMARC reporting service that turns the XML reports into readable summaries. If the address is at another domain, that service must publish an authorisation record, which this checker verifies.

Do subdomains need their own DMARC record?

Not necessarily. Without one, a subdomain uses the organisational domain's record, applying its sp policy (or p if no sp is set).

Will p=reject block my own email?

Only mail that fails both SPF and DKIM alignment. Use the monitoring phase and reports to make sure every legitimate sender passes before switching to reject.

What is the "pct" tag?

The percentage of failing messages the policy applies to. It lets you phase in quarantine or reject gradually. The default is 100.