Tools
DMARC Checker — Check DMARC DNS Record
Check a domain's DMARC DNS record, policy and common configuration issues.
Understand and repair a DMARC policy
The checker reads the TXT record at _dmarc, validates the policy tag and explains whether the domain is monitoring or enforcing. Start with visibility, identify every legitimate sender, then tighten policy gradually.
Frequently asked questions
Why is p=none a warning?
It collects reports but does not request quarantine or rejection. It is still the safest first stage.
Can I publish two DMARC records?
No. Publish one DMARC TXT record at _dmarc for the domain.
What this report checks
DMARC Checker queries _dmarc, validates the policy and turns monitoring or enforcement gaps into a staged remediation plan.
| Signal | Healthy result | Problem detected | Recommended action |
|---|---|---|---|
| Record presence | One v=DMARC1 TXT record | Missing or multiple DMARC policies | Publish exactly one TXT policy at _dmarc. |
| Policy | p=none during discovery, then quarantine or reject | Enforcement before legitimate senders align | Collect reports first and increase enforcement gradually. |
| Reporting | A monitored rua mailbox | No reports or an address nobody reviews | Use a dedicated address or reporting service you control. |
| Alignment | SPF or DKIM aligns with visible From | Authentication passes for a different domain | Configure aligned DKIM or an aligned return path for every sender. |
From result to verified repair
- 1Run the check for the organizational domain.
- 2Start with p=none and a working aggregate-report destination.
- 3Identify every sender and verify aligned SPF or DKIM.
- 4Move through quarantine to reject only after reports show the change is safe.
What this tool cannot prove
- Public DNS cannot show whether every real message aligns.
- The tool does not receive or interpret aggregate XML reports.
- DMARC protects identity but cannot guarantee inbox placement.
Worked examples
The checker queries the TXT record at _dmarc.yourdomain.com and reports the policy it finds.
v=DMARC1; p=none; rua=mailto:dmarc@example.comv=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.comv=DMARC1; p=reject; adkim=s; sp=quarantine; rua=mailto:dmarc@example.comCommon errors and fixes
If the checker finds nothing, or a policy you did not expect, look for these first.
- Record published at the root or at _dmarc.example.com.example.com instead of _dmarc: enter only _dmarc as the host.
- Two records at _dmarc: delete one so a single v=DMARC1 policy remains.
- Typo in the version tag, such as v=dmarc1 with extra text before it: the record must start with v=DMARC1.
- Reports to another domain never arrive: that domain must publish yourdomain._report._dmarc.theirdomain TXT "v=DMARC1".
Frequently asked questions
Why is p=none shown as a warning?
It collects reports but asks receivers to take no action on failing mail. It is the right first stage, but not a final state for a domain that sends mail.
Do subdomains need their own DMARC record?
Not necessarily. The organizational domain's policy applies to subdomains unless sp= or a record on the subdomain overrides it.
Does the checker read my DMARC reports?
No. It reads the published policy only; aggregate XML reports go to your rua address.
Why does mail fail DMARC when SPF passes?
SPF may pass for the sending service's own Return-Path domain, which does not align with your From domain. Set up DKIM signing with your domain, or a custom MAIL FROM subdomain, so at least one check passes for an aligned domain.
Overview
Check a domain's DMARC DNS record, policy and common configuration issues.
Authentication is the foundation
TXT proves control. MX directs incoming mail. SPF, DKIM and DMARC give receivers evidence that your messages are legitimate.