DMARC checker and record validatorDMARC record check
Breaks your DMARC record down tag by tag: what happens to spoofed mail, where reports go and whether external report addresses are authorized.
What this check looks at
- The _dmarc record, tag by tag
- Policy: p, sp, pct
- Alignment: adkim, aspf
- Report addresses and external authorization
- Records inherited from the organizational domain
What it reads and what it doesn't
DNS only: your _dmarc record, your organizational domain's record if yours is missing, and the authorization record of any report address on another domain. No email is sent.
What is DMARC?
DMARC is a DNS record that tells receiving servers what to do with mail that fails SPF and DKIM: nothing (p=none), send it to spam (quarantine) or reject it. It's the TXT record at _dmarc.yourdomain. Its reports show you who is sending mail as you, but only p=quarantine and p=reject actually stop spoofed mail.
DNS only: your _dmarc record, your organizational domain's record if yours is missing, and the authorization record of any report address on another domain. No email is sent.
What the policies mean
- p=none
- Monitoring only. Mail that fails is delivered as usual and you get reports. A good starting point, not a place to stay.
- p=quarantine
- Mail that fails goes to spam. Move here once reports show all your legitimate senders passing.
- p=reject
- Mail that fails is rejected and never reaches the inbox. This is the setting that stops people sending spoofed mail as you.
- Alignment
- Passing SPF or DKIM isn't enough for DMARC: the authenticated domain must match the domain in the From address. r is relaxed (subdomains count), s is strict (exact match).
Common problems and how to fix them
Every issue this check can flag, why it matters and what to change in DNS.
No DMARC record
Why it matters: Receivers don't know what to do with mail that fails SPF or DKIM, so spoofed mail in your name can be delivered. Since February 2024 Google and Yahoo require a DMARC record from anyone sending more than 5,000 messages a day.
What to do: Add a TXT record at the _dmarc name. Start with monitoring, read the reports, then move to quarantine and reject.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Monitoring-only policy (p=none)
Why it matters: p=none doesn't stop spoofing; it only collects reports. Spoofed mail in your name still reaches inboxes.
What to do: Confirm in the reports that your legitimate senders (mail provider, billing and marketing tools) pass SPF or DKIM, then move to p=quarantine and, a few weeks later, to p=reject.
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"Subdomains unprotected (sp=none)
Why it matters: Your main domain is protected, but spoofed mail can be sent from made-up subdomains such as billing.example.com.
What to do: Remove sp=none (subdomains then inherit p) or set sp=reject.
No report address (rua)
Why it matters: Without reports you can't see who sends mail as you or whether your legitimate senders pass, so you can't safely move to p=reject.
What to do: Add rua=mailto: with an address for reports. They're XML; a DMARC report service makes them readable.
External report address not authorized
Why it matters: If a report address is on another domain, that domain must publish a DNS record saying it accepts your reports (RFC 7489 §7.1). Without it, receivers won't send reports.
What to do: Ask your report service to publish the authorization record, or use an address on your own domain.
example.com._report._dmarc.report-service.com. TXT "v=DMARC1"Invalid tag value
Why it matters: Receivers ignore an invalid value or discard the whole record, so the policy isn't applied as you expect.
What to do: Fix the value: none, quarantine or reject for p and sp; a number from 0 to 100 for pct; addresses starting with mailto: for rua and ruf.
More than one DMARC record
Why it matters: With more than one record, receivers don't apply DMARC at all.
What to do: Merge them into one record and delete the rest.
Frequently asked questions
- How do I check my DMARC record?
- Enter your domain above. The check reads the _dmarc TXT record, explains each tag and flags problems. On the command line, dig TXT _dmarc.example.com shows the raw record.
- Is DMARC p=none enough?
- No. p=none only collects reports and doesn't stop spoofed mail. Once reports show all your legitimate senders passing, move to p=quarantine and then to p=reject.
- What are the Google and Yahoo DMARC requirements?
- Since February 2024, domains sending more than 5,000 messages a day to Gmail or Yahoo must publish SPF, DKIM and a DMARC record with at least p=none. Microsoft introduced a similar requirement for Outlook.com in May 2025.
- Why am I not getting DMARC reports?
- The two usual reasons: there's no rua address, or the report address is on another domain that hasn't published an authorization record. This check looks at both. Reports arrive daily, so the first one can take a day or two.
Primary sources
More quick checks
Each one answers a single question about a single record. No account needed.
SPF record check
Expands your domain's SPF record through every include, counts the DNS lookups it spends and flags the mistakes that send your mail to spam.
DKIM record check
Finds your DKIM signing key in DNS, reads its type and length, and flags keys that are weak, stuck in test mode or revoked.
MX lookup
Shows which servers receive email for your domain, in priority order, with each server's address, reverse DNS and provider.
Is it down?
Tries to open the site from two separate locations and tells you whether it's down for everyone or just for your connection.
SSL expiry check
Shows when your certificate expires, how many days are left and who issued it. Checks the apex and www separately and adds a calendar reminder.
To see every check in one report:Email security check