Get started ->
FREE TOOL

Free DMARC Record Checker

Type a domain and see its DMARC policy, every tag explained, where the reports go, and whether the policy only monitors or really protects. No sign-up.

Looked up through public resolvers (1.1.1.1, 8.8.8.8). Results are cached for five minutes.

What this checks

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com that tells receiving servers what to do with a message that claims to come from your domain but fails authentication: deliver it anyway (p=none), put it in spam (p=quarantine) or refuse it (p=reject). It also names an address where receivers send daily summary reports about the mail they saw with your domain in the From header.

This checker looks up the _dmarc record of the domain you type, as public DNS resolvers (1.1.1.1 and 8.8.8.8) see it right now. It reads every tag in the record, checks the syntax against RFC 7489, grades the policy, and points out what is missing or weak. If you type a subdomain that has no record of its own, the checker also looks at the organisational domain, because that is the record receivers apply to it.

DMARC works on top of SPF and DKIM. A policy only helps if your real mail passes at least one of them with a matching domain, so check SPF too before you tighten the policy.

How to read the result

Pass means a valid record with a policy that protects the domain and reports switched on. Warning means the record is valid but it only monitors, or applies to part of the mail, or sends no reports. Fail means receivers ignore the record. Missing means there is no DMARC record for this domain or its organisational domain. Could not check means our resolvers did not get an answer; it says nothing about your record, so try again in a minute.

Below the status you see the record as published and each tag with its meaning. Each finding links to its explanation here.

No DMARC record found

No TXT record starting with v=DMARC1 exists at _dmarc.yourdomain.com, and none at the organisational domain either. Receivers have no instruction for mail that fails SPF and DKIM alignment, so spoofed mail is delivered or filtered at each receiver's own discretion, and nobody sends you reports. Google, Yahoo and Microsoft require a DMARC record from bulk senders (more than 5,000 messages a day to their users).

The domain does not exist

Public DNS has no entry for the name at all, not even an empty one. Either the domain is not registered, it was registered minutes ago and its name servers are not answering yet, or there is a typo. Nothing about DMARC can be said until the name resolves; check the spelling and try again.

Inherited from the organisational domain

The subdomain you typed has no record of its own, so receivers use the record of the organisational domain (for mail.example.co.uk that is example.co.uk). The policy that applies to the subdomain is that record's sp tag if it has one, otherwise its p tag. The checker shows the inherited record and the effective policy.

More than one DMARC record

Two or more records start with v=DMARC1. The standard tells receivers to ignore all of them, so the domain has no policy at all. Delete the duplicate; this usually comes from a second service adding its own record.

Wrong version tag

The record must start with exactly v=DMARC1. The value is case-sensitive: v=dmarc1 is ignored by receivers, as is a record where the version tag comes later.

Syntax error

A tag has a value the standard does not allow: a policy that is not none, quarantine or reject; a pct outside 0–100; a report address without mailto:; a tag written twice; a missing p tag. The message says which one. Receivers either ignore the whole record or fall back to monitoring, so fix it first.

Policy is "none"

p=none only monitors. Receivers deliver mail that fails DMARC exactly as they would without a record, and send you reports about it. It is the right first step, because it shows you which legitimate services fail before you block anything. It is not the place to stay: a domain at p=none for years is as spoofable as one with no record.

Policy "quarantine"

p=quarantine asks receivers to put failing mail in the spam folder. Good protection with a safety net: a legitimate sender you forgot still reaches a mailbox, just not the inbox. Once the reports show no legitimate mail failing, p=reject is the final step.

Policy "reject"

p=reject is the strongest policy: receivers refuse mail that fails DMARC. Keep reading the reports; a new email service that is added without SPF or DKIM gets blocked immediately.

Missing "p" tag

The record has no valid policy tag. If it has a reporting address, receivers treat it as p=none; otherwise they ignore it. Add p=none, p=quarantine or p=reject right after v=DMARC1.

pct below 100

pct= applies the policy to only that percentage of failing mail; the rest gets the next weaker treatment (reject becomes quarantine, quarantine becomes none). It is a tool for a gradual rollout. Raise it to 100 when the reports are clean, or remove the tag, which means 100.

No reporting address

There is no rua= tag, so no receiver sends you aggregate reports. Without reports you cannot see which services send as your domain, which ones fail, or whether someone is spoofing you. Add rua=mailto:[email protected] or the address of a report service. The reports are XML files, once a day per receiver; a report service turns them into something readable.

Reports go to another domain

Your rua= address is on a different domain, which is normal with a DMARC report service. For receivers to send reports there, that domain must publish a yourdomain.com._report._dmarc.reportdomain.com TXT record saying it accepts them. Report services do this automatically; if you set up your own mailbox on another domain, add that record yourself. This checker does not verify it.

No subdomain policy

There is no sp= tag, so subdomains inherit p. That is usually what you want. Add sp= only when subdomains need a different policy, for example sp=reject on a domain that itself is still at p=none because its apex has many senders.

Subdomain policy is weaker than the policy

sp=none next to p=reject means anyone can send from an invented subdomain like billing.yourdomain.com and only meet the weaker rule. Remove sp= or set it to the same value as p=.

How to fix it

  1. Check SPF and DKIM first. DMARC needs at least one of them to pass with a domain that matches the From address. Use the SPF checker for the SPF half.
  2. Start with monitoring: publish v=DMARC1; p=none; rua=mailto:[email protected]; as a TXT record on the host _dmarc.
  3. Read the reports for two to four weeks. Every service that sends as your domain shows up. Fix the ones that fail (missing SPF include, DKIM not set up) until only mail you do not recognise fails.
  4. Move to p=quarantine, optionally with pct=25 first, and watch the reports again.
  5. Move to p=reject and set pct=100. Keep the reports coming: they are your early warning when someone adds a new email tool without telling you.

If you send with Ackuna: every sending domain you add gets its SPF, DKIM and DMARC records in the console, and Ackuna re-checks them and tells you when all three verify. Newsletters and transactional mail through the SMTP relay share the same verified domain, so there is one set of records to keep right.

Related pages
SPF Record CheckerRead more ->All free email toolsRead more ->Transactional email pricingRead more ->Agent MailRead more ->
FAQ

DMARC Record Checker questions

What is a DMARC record?

A DMARC record is a TXT record at _dmarc.yourdomain.com that starts with v=DMARC1. It tells receiving mail servers what to do with messages that use your domain in the From address but fail SPF and DKIM alignment, and where to send reports about them.

What does p=none mean?

p=none means "take no action, just report". Receivers deliver failing mail as usual and send daily aggregate reports to the address in rua=. It is the normal starting point, and the policy to move away from once your legitimate mail passes.

Do I need DMARC if I already have SPF?

Yes. SPF checks the hidden envelope sender, not the From address people see, and it says nothing about what receivers should do on failure. DMARC ties SPF and DKIM to the visible From domain and sets the policy. Google, Yahoo and Microsoft now expect a DMARC record from bulk senders.

Where do DMARC reports go and what do they look like?

They go to the rua= address, usually once a day from each large receiver, as compressed XML files. They list every sending IP that used your domain, how many messages it sent, and whether SPF and DKIM passed. A DMARC report service turns them into charts; a plain mailbox works but is hard to read.

My subdomain has no DMARC record. Is it protected?

Receivers fall back to the organisational domain's record. Its sp= tag, or its p= tag if there is no sp=, is the policy that applies to the subdomain. The checker shows which record it found and the effective policy.

Does Ackuna store the domains I check?

No. The result is cached for five minutes so a shared link shows the same answer, and a per-domain rate-limit counter lasts one minute; after that both are gone. Our logs record the tool name, the status and the timing of each run, not the domain.

Start sending in minutes

All three services free every month: 2,500 newsletter, 3,000 relay and 3,000 Agent Mail emails. No credit card required - upgrade only when your volume does.

Create free account ->Talk to sales