Deliverability

DMARC record checker

Look up and validate the DMARC record for any domain: policy, alignment, coverage, and reporting configuration, checked in seconds.

DMARC result

Enter a domain to look up and validate its DMARC record.

Instructions

How to use this tool

  1. 01Enter a domain like example.com. You can paste a full URL or email address and the tool extracts the domain.
  2. 02Click Check DMARC record. The tool queries the TXT record at _dmarc.yourdomain over DNS-over-HTTPS.
  3. 03Read the parsed tags: the p policy is the enforcement level, rua is where aggregate reports go, and pct is how much mail the policy covers.
  4. 04If the policy is p=none, plan a move to quarantine or reject once your reports show legitimate mail passing.

Background

What a DMARC record is

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record published at _dmarc.yourdomain that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment: deliver them anyway (p=none), send them to spam (p=quarantine), or reject them outright (p=reject). It also tells receivers where to send aggregate reports about your mail flow via the rua tag.

DMARC only works on top of SPF and DKIM. A message passes DMARC when at least one of the two passes and the domain it validated aligns with the visible From address, which is the part phishing attacks forge.

Background

Why p=none is only a starting point

Most domains start at p=none to collect reports without affecting delivery. That is the right first step, but none provides no protection: spoofed mail is still delivered. Google and Yahoo both require a DMARC record for bulk senders, and inbox providers increasingly factor enforcement into reputation.

The standard rollout is none, then quarantine with a low pct, then quarantine at 100, then reject. Each step is safe once aggregate reports show your legitimate sending sources passing alignment.

FAQ

Frequently asked questions

What does p=none mean in a DMARC record?

p=none is monitor mode: receivers report on mail that fails DMARC but deliver it normally. It gives you visibility without risk, but it does not stop spoofing. Move to quarantine or reject once reports confirm your legitimate mail passes.

Where does a DMARC record live?

In a TXT record at the _dmarc subdomain, for example _dmarc.example.com. The record must start with v=DMARC1 and include at least a p tag.

What is the rua tag?

rua lists the addresses that receive aggregate XML reports, usually as mailto: URIs. The reports summarize which sources sent mail as your domain and whether it passed SPF and DKIM, which is the data you need before tightening the policy.

Do I need DMARC if I already have SPF and DKIM?

Yes. SPF and DKIM authenticate mail, but without DMARC nothing connects them to the visible From address or tells receivers how to act on failures. Google and Yahoo also require DMARC for bulk senders.

More tools

Browse more free tools

DeliverabilitySPF checkerCheck the SPF record for any domain: parsed mechanisms, DNS lookup count against the 10-lookup limit, and the all qualifier, validated instantly.DeliverabilityDKIM checkerVerify DKIM signing configuration for any domain: auto-detect common selectors or check a specific one, with key type and public key validation.DeliverabilityMX lookupList the MX records for any domain with priorities, TTLs, and automatic identification of the email provider behind them.

The sender rules behind your DMARC record

Gmail, Yahoo, and Microsoft all require authenticated mail from bulk senders now, and each enforces it a little differently. Our breakdown covers what they check and what happens when you fail. Courier sends through your own email providers, so the domain and its records stay yours.

Read the sender requirements

Multichannel Notifications Platform for SaaS