Check a DMARC record
See the DMARC record a domain publishes, what every tag in it does, and the fix for anything wrong. No account.
Want DMARC managed for you?
We publish the record, read the daily reports, and move your policy from none to reject when the reports say it is safe, one click at a time.
What a DMARC record does
DMARC tells receiving mail servers what to do with mail that claims to come from your domain but fails authentication, and where to send reports about it. Without it, anyone can put your domain in the From line and most receivers will deliver the mail.
The three policies
p=none only collects reports. p=quarantine sends failing mail to spam. p=reject refuses it. Gmail and Yahoo require at least p=none from anyone sending in bulk, and a stricter policy is what actually stops spoofing.
What the checker looks for
A missing or duplicate record, a record that does not start with v=DMARC1, invalid policy or alignment values, a percentage under 100, a missing report address, reports sent to another domain, and tags that are not part of DMARC at all.
DMARC record questions
Where is a DMARC record published?
As a TXT record at _dmarc followed by your domain, for example _dmarc.yourcompany.com. There must be exactly one; with two, receivers ignore DMARC completely.
Is p=none bad?
It is the right place to start and the wrong place to stay. p=none asks receivers to deliver failing mail anyway and send you reports, so it protects nothing on its own. Read the reports, fix every source you use, then move to quarantine and reject.
Do I need SPF and DKIM first?
DMARC passes when SPF or DKIM passes for a domain that matches your From address. Without at least one of them set up for your domain, a strict policy would block your own mail.
Why are my reports not arriving?
Check that the record has a rua address. If that address is on another domain, that domain has to publish a record authorising it to receive your reports.