VerifyEmail
Sign Up
Free tool

Free DMARC Record Checker

Look up any domain's DMARC record and find out what it actually does — policy, subdomain coverage, reporting and alignment. Type your domain, sign up free, and the check runs on your 250 free credits. No credit card required.

Checks run inside the product with your free credits — every new account starts with 250. No credit card required.

Want to see who's actually sending as your domain? See DMARC monitoring →

What the DMARC check covers

Every tag a receiver reads when it evaluates your policy — checked inside the product, using the 250 free credits every new account starts with.

  1. 1 Record present

    Exactly one v=DMARC1 TXT at _dmarc

    Included in the check
  2. 2 Policy (p=)

    none / quarantine / reject

    Included in the check
  3. 3 Subdomain policy (sp=)

    Explicit or inherited coverage

    Included in the check
  4. 4 Coverage (pct=)

    Full vs. partial enforcement

    Included in the check
  5. 5 Reporting (rua=)

    Aggregate report destinations

    Included in the check
  6. 6 Alignment modes

    adkim= / aspf= relaxed vs. strict

    Included in the check

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy that tells receiving mail servers what to do with messages that claim to come from your domain but fail authentication. It's published as a single TXT record at _dmarc.yourdomain.com, and it builds directly on the two protocols beneath it: SPF (which IPs may send for your domain) and DKIM (a cryptographic signature on each message).

The piece DMARC adds — and the reason SPF and DKIM alone don't stop spoofing — is alignment. SPF and DKIM each authenticate a domain, but not necessarily the one shown in the From header your recipient reads. A spoofer can send from their own infrastructure, pass SPF and DKIM for their domain, and still display yours. DMARC closes that gap by requiring that the domain SPF or DKIM authenticated matches the From-header domain. Only then does the message pass; otherwise your published policy kicks in. You can check the other two records with the free SPF checker and DKIM checker.

Reading a DMARC record, tag by tag

A DMARC record is a semicolon-separated list of tags. A typical one looks like v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100. Here's what each tag means:

  • v=DMARC1 — the version, always first, always exactly this. And there must be exactly one DMARC record: publish two and receivers ignore both.
  • p= — the policy for mail that fails: none (deliver anyway, just report), quarantine (send to spam), or reject (refuse outright). This is the only required tag besides v=.
  • sp= — a separate policy for subdomains. When absent, subdomains inherit p=. Watch for sp=none next to a strict main policy — it leaves every subdomain spoofable.
  • pct= — the percentage of failing mail the policy applies to (default 100). It only has an effect with quarantine or reject, and it's meant as a rollout ramp, not a permanent setting.
  • rua= — where receivers send daily aggregate reports about mail using your domain. No rua= means no visibility.
  • ruf= and fo= — forensic (per-message failure) reports and the conditions for generating them. Nice when receivers send them; most no longer do.
  • adkim= and aspf= — alignment mode for DKIM and SPF: r (relaxed, the default — subdomain matches count) or s (strict — exact domain match only).

The rollout path: none → quarantine → reject

Nobody should publish p=reject on day one — you'd bounce your own newsletter the moment a misconfigured ESP fails alignment. The intended path is a ramp. Start at p=none with rua= set, and spend a few weeks reading the reports: they'll surface every service sending mail as your domain, including the ones nobody remembers signing up for. Fix each legitimate sender until it aligns. Then move to p=quarantine, optionally easing in with pct=25, then 50, then 100. When the reports show essentially all legitimate mail aligning, finish at p=reject — the only setting that actually stops spoofed mail from being delivered.

The most common DMARC mistake isn't a syntax error — it's publishing p=none and never coming back. It feels like protection because a checker like this one turns green on "record found", but p=none explicitly instructs receivers to deliver spoofed mail anyway. It's a starting line that most domains have quietly turned into a finish line.

What aggregate reports give you

The rua= tag is where DMARC stops being a static record and becomes a feedback loop. Receivers that process your mail — Google, Microsoft, Yahoo and others — send daily XML summaries of every source that sent mail claiming your domain: the sending IP, how many messages, and whether SPF and DKIM passed and aligned. That's how you discover the forgotten marketing tool that's about to break at p=reject, and it's how you find out someone in another country is spoofing your invoices. Without reports you're enforcing blind; with them, every policy step is a measured decision. Reading raw XML from a dozen receivers daily is nobody's idea of a workflow, though — parsing it into per-source dashboards and alerts is what DMARC monitoring does.

DMARC is now a requirement, not a best practice

Since February 2024, Google and Yahoo require bulk senders — roughly 5,000+ messages a day — to publish a DMARC policy, pass DMARC alignment, and meet related standards like one-click unsubscribe and low spam-complaint rates. Microsoft has followed with similar rules for Outlook. A missing or failing DMARC setup is no longer a theoretical spoofing risk; it's mail rejected at the door of the world's largest mailbox providers. If you send at any real volume, DMARC sits alongside list hygiene as table stakes for deliverability.

Your record is only half the story.

The DMARC check validates the policy you've published — it can't show you who's sending as your domain or whether they align. That evidence lives in your DMARC reports. Get them parsed, monitored and alerted on, starting with 250 free credits — no card required.

Get 250 free credits → See DMARC monitoring

DMARC checker — FAQ

Is this free?
Yes — every new account starts with 250 free credits, no credit card required, and you can spend them on any check: email verification, SPF/DKIM/DMARC checks, inbox placement tests. Type your domain above, sign up, and the DMARC check runs inside the product against your free credits.
What does p=none actually do?
Nothing to the mail — that's the point and the trap. p=none tells receivers to check DMARC, take no action on failures, and (if you set rua=) send you reports about what they saw. Spoofed mail is still delivered. It exists as a safe starting position while you discover all your legitimate senders, not as a destination. If your record has been at p=none for a year, you have a monitoring setup, not protection.
How do I move from p=none to p=reject safely?
In stages, guided by your aggregate reports. First run p=none with rua= for a few weeks and fix every legitimate sender that isn't aligning (your ESP, CRM, helpdesk, that forgotten billing system). Then move to p=quarantine, optionally ramping with pct= (25 → 50 → 100). When the reports show ~100% of legitimate mail aligning, switch to p=reject. The DMARC monitoring product tracks alignment per source and tells you when each step is safe.
Do I need DMARC if I already have SPF and DKIM?
Yes. SPF and DKIM authenticate mail, but neither one checks the From address your recipient actually sees — a spoofer can pass both using their own domain while displaying yours. DMARC adds that missing link (alignment) and tells receivers what to do on failure. Check your other records with the free SPF checker and DKIM checker — all three need to be right.
What are rua reports and how do I read them?
Aggregate (rua) reports are XML files that receivers like Google and Microsoft email to the address in your rua= tag, typically daily. Each one summarizes every source that sent mail claiming to be your domain: the IP, the volume, and whether SPF and DKIM passed and aligned. Reading them by hand means unzipping and parsing XML from a dozen receivers every day — fine once, miserable forever. DMARC monitoring parses them into a per-source dashboard and alerts you when a new sender appears.
Does DMARC apply to subdomains?
Yes, in two directions. A subdomain with no DMARC record of its own inherits the policy of the organizational domain (which is why the check also considers the organizational domain when a subdomain comes up empty). And your record can set a separate subdomain policy with sp= — beware of sp=none next to a strict main policy, which invites spoofers to simply send from anything.yourdomain.com.
What's the difference between rua and ruf?
rua= requests aggregate reports — daily XML summaries of pass/fail counts per sending source. ruf= requests forensic (failure) reports — individual samples of messages that failed, sent in near real time. Most receivers no longer send ruf for privacy reasons, so build your rollout on rua and treat ruf as a bonus.
Do Google and Yahoo really require DMARC?
For bulk senders, yes — since February 2024, anyone sending roughly 5,000+ messages a day to Gmail or Yahoo must publish a DMARC policy (p=none is enough to comply), pass DMARC alignment, and meet related requirements like one-click unsubscribe. Fall short and your mail is rejected or spam-foldered regardless of content. If deliverability is the goal, start with the deliverability suite.
The check says my record is fine — am I done?
Not quite, and we'd rather be honest about that. The DMARC check validates the policy you've published — syntax, tags, and the obvious footguns. What it can't see is your traffic: which servers are actually sending as your domain, whether your legitimate senders align, and whether a spoofer showed up yesterday. That evidence only exists in your aggregate reports, which is exactly what DMARC report monitoring is for.

Publish the policy. Then watch it work.

A DMARC record without report monitoring is enforcement in the dark. VerifyEmail parses every aggregate report and alerts you when someone sends as you — starting with 250 free credits.

Get Started Free Explore DMARC monitoring →

Includes 250 free credits · No credit card required