Free DMARC record checker.
Type a domain and get its DMARC record back: the policy receivers will apply, where your reports go, and whether the record is actually complete. Built for senders who would rather clear the Gmail and Yahoo bulk requirements before a campaign than find out during one.
Privacy: this tool runs entirely in your browser. When you click Check, one DNS query for the domain you typed goes to Cloudflare's public DNS resolver (Google's as fallback). Nothing is stored, logged or sent to GrowthPal.
DMARC at a glance
| Item | Value |
|---|---|
| Record location | A TXT record at _dmarc.yourdomain.com, not at the root |
| Minimum viable record | v=DMARC1; p=none; rua=mailto:you@yourdomain.com |
| Policies | none, quarantine, reject, in that order of strictness |
| What it adds over SPF and DKIM | Alignment: the authenticated domain has to match the From address your recipient sees |
| Bulk sender requirement | Gmail and Yahoo have required DMARC from senders above 5,000 messages a day to their users since February 2024 |
| Specification | RFC 7489, published March 2015 |
What is a DMARC record?
DMARC is a DNS policy record that tells receiving servers what to do with mail that claims to come from your domain but fails authentication. It sits on top of SPF and DKIM rather than replacing either.
The part that matters is alignment. SPF checks the envelope sender and DKIM checks a signature, and neither of them looks at the From address a human actually reads. That gap is what makes spoofing work: a forger can pass SPF on a domain they control while displaying yours in the From line. DMARC closes it by requiring the authenticated domain to match the visible one, then telling receivers what to do when it does not.
It also turns on reporting, which is the underrated half. Aggregate reports show you every source sending as your domain, including the ones you forgot about, which is the only way to move to a strict policy without breaking your own mail.
How to read your DMARC check result
The checker reads the record at _dmarc. plus your domain and reports on it line by line.
The policy row is the one that decides what happens to failing mail. reject and quarantine come back as healthy, none comes back as a warning because it is monitoring only, and a record with no p= at all comes back as broken: receivers ignore an incomplete record entirely.
The reporting row shows where aggregate reports go. No rua tag is flagged, because without reports you cannot see who is sending as you, and without that you can never safely tighten the policy.
The pct row appears when your record applies the policy to only a share of failing mail, and the subdomain row appears when sp sets a different policy for subdomains than for the domain itself.
One thing the check cannot tell you: whether your mail actually passes. A perfect record with p=reject will happily reject your own newsletters if a sender was never aligned. That is what the reports are for, and why nobody should jump straight to reject.
What each DMARC tag does
| Tag | What it does | Default |
|---|---|---|
v | Version. Must be DMARC1 and must come first, or the record is ignored. | Required |
p | Policy for the domain itself: none, quarantine or reject. | Required |
rua | Where aggregate reports are sent. The tag that makes DMARC useful. | None |
ruf | Where failure reports go. Patchily supported and carries recipient data, so used rarely. | None |
pct | Percentage of failing mail the policy applies to. A ramp, not a permanent setting. | 100 |
sp | Policy for subdomains. | Inherits p |
adkim | DKIM alignment mode: r relaxed accepts a subdomain, s strict demands an exact match. | r |
aspf | SPF alignment mode, same two options. | r |
fo | Which failures generate a report. Only meaningful alongside ruf. | 0 |
ri | Aggregate reporting interval, in seconds. | 86400 |
What each policy actually does
| Policy | What receivers do | When it is right |
|---|---|---|
p=none | Deliver as they would anyway, and send you reports. | The first two to four weeks, and the minimum that satisfies the bulk sender rules. |
p=quarantine | Put failing mail in spam. | Once a few weeks of reports show only senders you recognize. |
p=reject | Refuse failing mail at the door. It never reaches a folder. | Once quarantine has run clean and nothing legitimate is failing. |
How to move from p=none to p=reject without breaking your own mail
The ladder exists because every domain has a sender nobody remembers. The point of each rung is to find it while the consequences are still reversible.
- Publish p=none with a rua address. This changes nothing about delivery and starts the reports flowing the same day. v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- Read two to four weeks of reports. You are looking for one thing: sources sending as you that you did not expect. Billing tools, an old CRM, a help desk, a marketing platform someone set up in 2021.
- Fix each legitimate sender. Either add it to SPF, or have it sign with DKIM on your domain. A provider signing with its own domain will not align, whatever your SPF says.
- Move to quarantine, optionally on a percentage.
pctlets you apply the policy to a quarter of failing mail while you watch. v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com - Raise to 100%, then to reject. Only once a full reporting cycle at quarantine shows nothing legitimate failing.
- Set the subdomain policy explicitly. Subdomains inherit your policy by default, which is usually what you want, but say so deliberately rather than by accident.
Common questions about DMARC
What does p=none actually do to my mail?
Nothing. It tells receivers to take no special action when a message fails authentication and simply send you reports. That is enough to satisfy the Gmail and Yahoo bulk sender requirement, and it buys you the visibility to move to a stricter policy later without risking a single legitimate message.
Do I need DMARC if SPF and DKIM already pass?
Yes, for two reasons. Gmail and Yahoo require it from bulk senders. And neither SPF nor DKIM on its own checks the From address your prospect actually sees, so without DMARC's alignment requirement a message can pass both while displaying someone else's domain.
What is the difference between relaxed and strict alignment?
Relaxed, the default, accepts a subdomain: mail signed by mail.yourdomain.com aligns with yourdomain.com. Strict demands an exact match. Relaxed is correct for almost everyone, because strict breaks the moment a provider signs with a subdomain of its own.
Where do DMARC reports go and can I read them?
To whichever address you put in the rua tag. They arrive daily as compressed XML from every major receiver and are effectively unreadable by hand once volume picks up. Point them at a mailbox you use for nothing else, or at a parser that turns them into something legible.
Does DMARC affect mail sent through third-party platforms?
Yes, and this is where most rollouts break. A platform sending as your domain has to either be listed in your SPF record or sign with DKIM using your domain. A provider that signs with its own domain will fail alignment no matter how correct your SPF is, and under reject that mail stops arriving.
What happens to forwarded mail under p=reject?
It usually survives, because DMARC passes if either SPF or DKIM aligns. Forwarding breaks SPF, since the forwarding server is not on your list, but DKIM signs the message itself and stays valid. That is exactly why DKIM matters more than SPF once you reach reject.
Tools check the plumbing. The message is what your market answers. Get your TAM mapped, your ICP broken down and 5 angles written for your buyers, free.