Free DMARC Record Checker

What the DMARC checker tests

• Record exists at _dmarc.yourdomain.com, and only once. Receivers ignore DMARC entirely when they find more than one record.
• Policy (p) is present and valid: none, quarantine or reject.
• Reporting (rua) is set to a mailto: address so you receive aggregate reports.
• Percentage (pct), subdomain policy (sp) and alignment modes (adkim, aspf) hold valid values.
• Inheritance. For a subdomain without its own record, the checker shows the policy inherited from the main domain.

How DMARC works

DMARC builds on SPF and DKIM. A message passes DMARC when it passes SPF or DKIM and the domain that passed matches the domain in the visible From address. This alignment step is what stops spoofing: an attacker can pass SPF for their own domain, but not for yours.

A record that monitors and collects reports looks like this:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Once reports show all legitimate mail passing, a protective record looks like this:

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s

A safe path to p=reject

1. Publish p=none with a rua address. Change nothing else.
2. Read the aggregate reports for two to four weeks. List every service that sends as your domain: your mailbox provider, marketing platform, CRM, help desk, billing system.
3. Fix SPF and DKIM for each legitimate service until it passes with alignment.
4. Move to p=quarantine, optionally with pct=25 first, and watch for complaints about missing mail.
5. Move to p=reject when quarantine has run cleanly.

Need a record to start with? The DMARC record generator builds one from a few choices.

DMARC and list quality

DMARC protects your domain's identity. It does not protect your reputation from what you send. High bounce rates from old or unverified lists are one of the fastest ways to land in spam even with a perfect DMARC setup. Verify addresses before you send to keep bounces low.