DMARC record checker
Look up and validate a domain's DMARC record, read back what its policy actually does, and see what is needed to move to enforcement.
What this catches
Every problem below is one this tool detects and explains, with the record to publish.
DMARC policy applies to only part of your mail
The pct tag is below 100, so the policy is applied to a sample of messages.
DMARC policy is set to none
The policy monitors but does not act — failing mail is still delivered.
DMARC record contains a syntax error
A tag in the DMARC record is malformed, which can invalidate the whole policy.
DMARC record requests no aggregate reports
There is no rua address, so you receive no data about who sends as your domain.
DMARC uses relaxed alignment
Subdomains of your organisational domain count as aligned. This is the default and is usually correct.
External reporting address is not authorised
Reports are directed to another domain that has not published the required authorisation record.
More than one DMARC record published
Multiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.
No DMARC record found
There is no DMARC policy at _dmarc for this domain.
Subdomain policy is weaker than the domain policy
sp= is set to a laxer value than p=, leaving subdomains less protected.
Common questions
- What does p=none actually do?
- Nothing, to the mail itself. Receivers evaluate DMARC and send you reports, but deliver failing messages exactly as they would with no DMARC record at all. It is the correct place to start, and it only becomes useful once you read the reports and move to quarantine or reject.
- Do I need a DMARC record?
- Google, Yahoo and Microsoft require bulk senders to publish at least p=none, and enforcement is active. Beyond that requirement, without DMARC you have no visibility into who is sending mail using your domain and no way to tell receivers what to do about forgeries.
- Why am I not receiving DMARC reports?
- Either the record has no rua tag, or the reporting address is at a different domain that has not published an authorisation record. In the second case the DMARC record looks perfectly valid, which is why it is so easy to miss.
Related tools
- Full domain health checkCheck SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI for any domain in one pass, with the exact records and the fix for anything that is wrong.
- SPF checkerLook up a domain's SPF record, validate its syntax, and count the DNS lookups it costs — including every nested include — against the limit of ten.
- DKIM checkerCheck a DKIM selector for a domain, validate the record, and read the key strength. Leave the selector blank to probe the selectors common providers use.
- MX lookupList a domain's mail exchangers and priorities, confirm each resolves to a reachable address, and catch the misconfigurations that break inbound mail.