Home / DMARC Check
Validate the DMARC policy that tells receivers what to do with spoofed email.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.yourdomain.com. It tells receiving mail servers what to do with email that fails SPF and DKIM checks, and where to send reports about it.
With DMARC you can see who sends email in the name of your domain, and ask receivers to treat unauthorized messages as suspicious or to refuse them.
What you can find in a record.
| Tag | Meaning |
|---|---|
| v | The version. It must be DMARC1 and come first. |
| p | The policy for the domain: none (only monitor), quarantine (treat as suspicious) or reject (refuse). |
| sp | The policy for subdomains. If it is missing, subdomains use the p policy. |
| pct | The share of messages the policy applies to. The default is 100. |
| rua | Where aggregate reports are sent. These reports show who sends email as your domain. |
| ruf | Where failure reports are sent. Few receivers send them. |
| adkim / aspf | The alignment mode for DKIM and SPF: r is relaxed and s is strict. |
The most common DMARC problems.
Quick answers about DMARC Check.
Many domains start with p=none and a rua address to collect reports, fix every legitimate sender, and then move to quarantine and finally reject.
Yes. A message passes DMARC when SPF or DKIM passes and matches the domain in the From address. Check both with SPF Check and DKIM Check.
At the name _dmarc under your domain, for example _dmarc.example.com, as a TXT record.
No. A subdomain without its own record uses the policy of its parent domain. The tool tells you when this happens.
Reports are sent by receivers, usually once a day, and only if the rua address is valid and authorized. It can take a day or two for the first reports to arrive.