Email authentication validator
🛡️ DMARC Checker
Inspect any domain's DMARC record, understand every field, catch misconfigurations and get actionable email-security tips.
What is a DMARC record?
A DMARC (Domain-based Message Authentication, Reporting and Conformance) record is a DNS TXT record at _dmarc.yourdomain.com that tells receiving mail servers what to do with email that claims to be from your domain but fails authentication. DMARC is defined in RFC 7489.
A message passes DMARC when SPF or DKIM passes and the domain that passed matches ("aligns with") the From address the reader sees. That alignment is what stops attackers putting your domain in the From line.
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r
DMARC tags explained
| Tag | What it does | Values (default) |
|---|---|---|
| v | Version. Must be first. | DMARC1 (required) |
| p | Policy for mail that fails DMARC. | none, quarantine, reject (required) |
| sp | Policy for subdomains. | Same values (inherits p) |
| pct | Percentage of failing mail the policy applies to. Useful for gradual rollout. | 0-100 (100) |
| rua | Where daily aggregate (XML) reports are sent. | mailto: URIs (none) |
| ruf | Where per-message failure reports are sent. Few receivers send them. | mailto: URIs (none) |
| adkim | DKIM alignment: relaxed allows subdomains, strict needs an exact match. | r, s (r) |
| aspf | SPF alignment, same idea. | r, s (r) |
| fo | When to generate failure reports. | 0, 1, d, s (0) |
| ri | Requested seconds between aggregate reports. | (86400 = daily) |
How to roll out DMARC safely
- Set up SPF and DKIM for every service that sends as your domain (mail provider, newsletter tool, CRM, invoicing). Check SPF with our SPF Checker.
- Monitor with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Read the aggregate reports for 2-4 weeks and fix any legitimate sender that fails.
- Quarantine gradually: p=quarantine; pct=25, then 50, then 100 as reports stay clean.
- Reject: p=reject. Spoofed mail using your domain is now refused by receivers that enforce DMARC.
Common DMARC problems and how to fix them
| Problem | What happens | Fix |
|---|---|---|
| No DMARC record | Anyone can put your domain in the From line; large mailbox providers may also throttle your mail. | Start with v=DMARC1; p=none; rua=mailto:… at _dmarc.yourdomain.com. |
| Two DMARC records | Receivers ignore DMARC for the domain. | Keep exactly one TXT record starting with v=DMARC1. |
| p=none for months | Monitoring only; spoofed mail is still delivered. | Use the reports, then move to quarantine and reject. |
| rua without mailto: | Reports are never sent. | Write rua=mailto:dmarc@yourdomain.com. |
| Reports sent to another domain | The receiving domain must authorise it, or reports are dropped. | The report domain publishes yourdomain.com._report._dmarc.reportdomain.com TXT v=DMARC1 (most report services do this for you). |
| Legit mail fails after enforcing | A sender isn't in SPF or doesn't sign with your DKIM domain. | Find it in the aggregate reports, then add it to SPF and enable DKIM signing for your domain. |
| sp weaker than p | Attackers spoof anything.yourdomain.com instead. | Remove sp (it inherits p) or set it equal. |
Frequently Asked Questions
What does this DMARC checker do?
It looks up your domain's DMARC record (the TXT record at _dmarc.yourdomain.com), then explains each field - policy, alignment, reporting addresses - and flags weak or missing settings.
Is the DMARC checker free and private?
Yes. The lookup runs in your browser via public DNS-over-HTTPS. We don't store the domains you check.
What DMARC policy should I use?
p=reject gives the strongest protection. p=quarantine is a good intermediate step, and p=none only monitors - it offers no enforcement.
Why does my domain show no DMARC record?
It likely hasn't been set up yet. Add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1 and a policy, after confirming SPF and DKIM are in place.
What is DMARC alignment?
DMARC passes only when SPF or DKIM passes for a domain that matches the visible From domain. Relaxed alignment (the default) accepts a subdomain match; strict alignment needs an exact match.
Do I need both SPF and DKIM for DMARC?
DMARC passes if either one passes and aligns, but set up both. DKIM survives email forwarding, while SPF usually breaks when a message is forwarded.
Learn more at dmarc.org · Last updated by Lazy Devs.