DMARC record checker
Enter your domain and we'll read your DMARC record and interpret the policy. The question that matters: does your record actually block forged mail, or does it only watch it? For most domains the answer is the latter.
No signup, no email required. Only public DNS records are read.
The three policy levels
All of DMARC comes down to one tag: p=. It tells receivers what to do with a message that fails both SPF and DKIM authentication.
| Policy | What happens | When |
|---|---|---|
| p=none | Nothing — mail is delivered, you only get reports. | Initial rollout, first 2-4 weeks. |
| p=quarantine | Failing mail goes to the spam folder. | Once the reports are clean. |
| p=reject | Failing mail is never delivered. | The target level — stay here. |
What is DMARC, and how is it different from SPF?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that ties SPF and DKIM results to a policy. It's published as a TXT record at _dmarc.yourdomain.com.
On their own, SPF and DKIM only produce a result: pass or fail. They don't say what to do with that result — they leave the decision to the receiver. DMARC fills exactly that gap: it lets you say 'reject mail sent as me that fails authentication'.
Its second, less known function is reporting: you receive regular reports of who is sending as your domain, from which IPs and with what result. Most companies discover services they had forgotten about in these reports.
Why p=none is not protection
A large share of domains publish a DMARC record and stop at 'p=none'. The setup looks complete, checkers show green, but forged mail sent as the domain is not blocked in any way.
'none' is a monitoring mode, and its correct use is temporary: publish the record, collect reports for 2-4 weeks, identify every legitimate service sending as you, add them all to SPF and DKIM. Then move to 'quarantine', then 'reject'.
Without that move, the only benefit of DMARC is the report. When a phishing campaign hits, you'll see it in the report — after the mail has already reached your customer.
The phased rollout: from none to reject
Starting straight at 'p=reject' is risky: if any service sends as you but isn't listed in SPF or signing with DKIM — a billing system, payroll, appointment reminders, an old marketing tool — its mail starts being rejected immediately.
The safe order is: publish 'p=none' with 'rua=mailto:...'. Watch the reports for a few weeks and fix the legitimate services that fail. Then switch to 'p=quarantine', optionally using 'pct=' to ramp up gradually. Finally move to 'p=reject' with 'pct=100'.
This usually takes 4-8 weeks. It isn't a process to rush — but if you never start it, it never ends.
Who is going to read the reports?
Reports arriving at your 'rua' address are XML and not meant to be read by hand; dozens arrive per day. For a small domain, filing them in a folder and glancing occasionally may be enough, but for real monitoring you'll want a DMARC reporting service.
Keeping the reporting address on your own domain is simplest. If you point it at an address on a different domain, that domain must publish an authorisation record accepting reports for you — otherwise no reports arrive at all.
The 'ruf' (forensic report) tag asks for samples of the messages themselves. Because those contain personal data, most providers no longer send them; it's usually skipped.
DMARC alone isn't enough either
DMARC is a policy layer; it performs no authentication itself and simply reads the SPF and DKIM results. If those two aren't set up correctly, moving DMARC to 'reject' does nothing but reject your own mail.
The right order is: clean up SPF first (including the 10 lookup limit), confirm your DKIM signature works, and tighten the DMARC policy last. With all three in place, forging mail from your domain becomes practically impossible.
Frequently asked questions
How do I check a DMARC record?
Enter your domain in the tool on this page; it reads your _dmarc record and interprets your policy and reporting addresses. You can also see the raw record with 'dig +short TXT _dmarc.yourdomain.com'.
What's the difference between p=none and p=reject?
p=none only monitors: failing mail is still delivered and you just receive reports. p=reject means failing mail is never delivered. Real protection starts at p=reject; p=quarantine sits in between and routes failing mail to the spam folder.
Is a DMARC record mandatory?
Not legally, but large providers such as Gmail and Outlook now expect a DMARC record from domains that send in bulk. Domains without one see noticeably more mail land in spam.
Where do I add the DMARC record?
In your DNS panel, as a TXT record named '_dmarc'. The full name is _dmarc.yourdomain.com; many panels append the domain automatically, so entering just '_dmarc' is enough.
Do subdomains need their own DMARC record?
No. Subdomains inherit the parent domain's policy. You only publish a dedicated _dmarc record if you want a different policy for a specific subdomain. The 'sp=' tag can also set one policy for all subdomains at once.
Is this tool free? Do I need an account?
It's completely free and requires no account or email address. It only reads public DNS records.