Free tool
DMARC checker
Look up a domain's DMARC record, read its policy and reporting settings, and see what to change before you move to enforcement.
In short
A DMARC record is a TXT record at _dmarc.yourdomain.com that tells receivers what to do with mail that fails SPF and DKIM alignment: p=none to monitor, p=quarantine to send it to spam, or p=reject to refuse it. Google and Yahoo require bulk senders to publish one.v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r
What a valid DMARC record needs
A record at the right name. DMARC lives at _dmarc.yourdomain.com, not at the domain itself, and must start with v=DMARC1 followed by a p= policy. A record anywhere else, or one missing p=, is ignored.
A policy that matches where you are. p=none collects reports without affecting delivery; p=quarantine asks receivers to treat failing mail as spam; p=reject asks them to refuse it. sp= sets a separate policy for subdomains, and pct= applies the policy to only a share of failing mail while you roll it out.
Somewhere for reports to go. rua= takes a mailto address that receives daily aggregate reports - which servers sent as your domain and whether they passed. Without it, p=none tells you nothing.
Moving from p=none to p=reject
Start at p=none with a rua address and read the reports for a few weeks. Every legitimate service sending as your domain should show SPF or DKIM passing for your domain - aligned, in DMARC's terms. Fix the ones that do not, by adding them to SPF or setting up DKIM signing with your domain.
Then move to p=quarantine, optionally with pct= to start small, and finally p=reject once the reports show only your own services. Since February 2024, Gmail and Yahoo require anyone sending more than 5,000 messages a day to their users to publish DMARC; p=none satisfies that rule, but only enforcement stops other people spoofing your domain.
How the three authentication records work together is explained in SPF, DKIM and DMARC explained.
Questions
How do I check my DMARC record?
Enter your domain above. The checker reads the TXT record at _dmarc on your domain, explains its policy, and warns if there is no p= policy or no rua address for reports.
What DMARC policy should I use?
Start with p=none and a rua reporting address, read the reports for a few weeks, then move to p=quarantine and p=reject once only your own services send as your domain.
Is DMARC required?
Gmail and Yahoo have required DMARC for bulk senders - more than 5,000 messages a day to their users - since February 2024. A p=none record meets that requirement; every sending domain benefits from one.
What does DMARC alignment mean?
DMARC passes only when SPF or DKIM passes for a domain that matches the visible From address. Relaxed alignment (the default) accepts a subdomain of the same organisational domain; strict alignment requires an exact match.
More free email tools
SPF record checker
Check any domain's SPF record. Flags duplicate records, too many DNS lookups and a missing or permissive all mechanism. Free, no sign-up.
DKIM checker
Look up a DKIM record by domain and selector. Checks the public key is published, readable and not revoked, and shows how to find your selector. Free.
MX record lookup
Look up any domain's MX records to see which servers receive its mail and in what order, alongside its SPF and DMARC. Free, no sign-up.
Email address checker
Check whether an address can receive mail before you send to it.
Send your first email in minutes
6,000 emails a month (up to 200 a day), free forever. No card needed.