DMARC Checker
Validate a domain's DMARC record: policy, subdomain policy, pct, reporting addresses, alignment and common mistakes.
Check a DMARC record
Reads _dmarc.domain, or the organisational domain's record when a subdomain has none.
What the DMARC Checker does
DMARC Checker reads the TXT record at _dmarc.yourdomain and checks every tag against the specification: the policy (p), the subdomain policy (sp), the percentage (pct), the aggregate and failure report addresses (rua, ruf), the alignment modes for DKIM and SPF (adkim, aspf), the failure reporting options (fo), the report format (rf) and interval (ri). Anything missing, misspelled or out of range is listed with what to change.
When you check a subdomain that has no record of its own, the tool does what receivers do and walks up to the organisational domain, then explains which policy actually applies there. It also tells you whether the record is enforcing anything: p=none with no reporting address is the most common setup and offers no protection at all, while quarantine or reject at pct=100 is what stops spoofing.
Since February 2024 Gmail and Yahoo require bulk senders to publish DMARC, and Microsoft followed in 2025, so a valid record is now a deliverability requirement rather than a nice-to-have.
Step by step
- 01Enter your domain. For a sending subdomain, enter the subdomain and the tool will find the governing record.
- 02Press Check. The _dmarc record is fetched from the public DNS and parsed.
- 03Read the effective policy and the Enforcing pill. Then go through the warnings in order.
- 04Fix the record at your DNS provider and check again; TTLs are usually short enough to see the change within minutes.
Common questions
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. It changes nothing about delivery and starts daily aggregate reports from Gmail, Microsoft, Yahoo and others listing every source sending as your domain. After two to four weeks you will know which senders need SPF or DKIM fixed before you move to p=quarantine.
p applies to the domain itself; sp applies to all subdomains that have no record of their own. When sp is absent, subdomains inherit p. Attackers like subdomains because nobody watches them, so set sp=reject once your real sending subdomains have their own records or pass alignment.
A receiver will only send reports to an address on another domain if that domain publishes a TXT record at yourdomain._report._dmarc.otherdomain containing v=DMARC1. Report processing services add this automatically. If you point rua at a personal address on another domain, add that record or the reports are silently dropped.
Only mail that fails both SPF and DKIM alignment. Forwarded mail usually keeps a valid DKIM signature, and mailing lists that rewrite the From header pass by definition. The way to find anything that would break is the aggregate reports under p=none first; that is what the monitoring stage is for.
Keep checking
SPF Checker
Validate a domain's SPF record: mechanisms, the include tree, the 10 DNS lookup limit, +all and syntax mistakes.
Free toolDKIM Checker
Find and validate a domain's DKIM record by selector: tags, key type and size, test mode, or try the common selectors.
Free toolEmail Header Analyzer
Paste raw email headers to see the delivery path hop by hop with delays, SPF, DKIM and DMARC results and spoofing warnings.
Free toolDNS Lookup
Look up the A, AAAA, CNAME, MX, NS, TXT, SOA, SRV and CAA records of any domain with their TTLs in one query.
Free toolBlacklist Checker
Check whether an IP or mail server is listed on Spamhaus, SpamCop, Barracuda, SORBS and ten more DNS blacklists.
Want these fixes done for you?
Our team runs the audit, makes the changes and reports the result.