DMARC Checker
Look up and validate a domain's DMARC record and policy.
Enter a domain to look up its DMARC record, check the policy and see exactly what is protecting it. We read the live record straight from DNS over an encrypted connection. Nothing is stored.
The DMARC Checker looks up the _dmarc TXT record published in your domain's DNS and parses it the way a receiving mail server does. It confirms the record exists, starts with v=DMARC1, and reports the policy and tags it contains so you can see exactly how inbox providers will treat messages that fail authentication.
Why your DMARC record matters
DMARC (RFC 7489) tells receivers what to do with email that fails SPF or DKIM alignment, and where to send reports. Without a published policy, spoofed mail claiming to come from your domain can reach inboxes unchecked. A correct record is also a prerequisite for BIMI and is increasingly demanded by bulk-sender rules at the major mailbox providers.
Reading the result
The key tag is the policy. p=none only monitors and asks for reports; p=quarantine sends failing mail to spam; p=reject blocks it outright. Check that rua= points at a mailbox you control so aggregate reports actually arrive, and watch for these common faults:
- Two DMARC records on
_dmarc: the standard treats this as no policy at all, so merge them into one. - Stuck at
p=none: monitoring only, with no protection. Move to quarantine, then reject, once your reports are clean. - A low
pctapplying the policy to only a fraction of mail. - No
rua, so you are blind to what is failing.
To progress safely from monitoring to full enforcement, see our enforcement guide or let DMARC Engine handle the ramp-up for you. You can also run the related SPF and DKIM checks to confirm both authentication methods align.
Frequently asked questions
Where is a DMARC record published?
It lives as a DNS TXT record at the host _dmarc.yourdomain.com, not on the root domain. The checker queries that exact name and reads the first valid v=DMARC1 string it finds.
What does p=none actually do?
Nothing to the mail flow: p=none is monitor-only. Receivers still send you aggregate reports via the rua address, but failing messages are delivered normally. It is a safe starting point, not a finished configuration.
Can I have more than one DMARC record?
No. RFC 7489 requires exactly one DMARC record per domain. If two or more v=DMARC1 TXT records exist at _dmarc, receivers ignore the policy entirely, leaving you unprotected.
The checker found my record but no rua tag. Is that a problem?
It means no one is receiving aggregate reports, so you cannot see who is sending as your domain or whether legitimate mail is failing. Add rua=mailto:reports@yourdomain.com before tightening the policy.
Does a subdomain need its own DMARC record?
Not necessarily. The sp tag on your organisational record sets the policy for subdomains, and they inherit p if sp is absent. Publish a dedicated subdomain record only when you need different handling.
Why does the policy say reject but spoofed mail still gets through?
DMARC only acts when SPF and DKIM both fail to align with the visible From domain. If a forwarder or a misconfigured legitimate source is passing one of them, or a low pct exempts some mail, enforcement is incomplete. Review your authentication audit to close the gaps.