DMARC Record Checker

About DMARC Record Checker

DMARC Record Checker reads the DMARC policy published at _dmarc on a domain and explains what it actually does. DMARC ties SPF and DKIM together by adding two things neither has on its own: alignment, which requires the authenticated domain to match the address a recipient sees, and a published policy telling receivers what to do when a message fails. The tool parses each tag and flags the problems that make a record look protective while doing nothing. The most common by far is p=none, which is a monitoring mode: it asks for reports but instructs receivers to deliver failing mail normally. Many domains publish it as a first step and never move on, which leaves them no better protected than before. A missing rua address is the other frequent gap, since without it you receive no aggregate reports and have no way to see what is failing before tightening the policy. A pct value below 100 applies the policy to only a fraction of mail. Check this together with SPF Record Checker and DKIM Record Lookup, because DMARC only passes when at least one of them passes and aligns.

DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.

How to use DMARC Record Checker

  1. Enter a domain name (e.g. example.com, without http://).
  2. Select a record type (A, AAAA, MX, TXT, CNAME, NS, SOA, CAA, SRV, PTR) or an email policy check (DMARC, SPF, DKIM).
  3. Click Lookup to see live DNS records, then copy all results with one click.

Frequently Asked Questions

What is a DMARC record?
A DMARC record is a TXT record published at _dmarc.yourdomain.com that tells receiving mail servers how to handle messages failing SPF and DKIM, and where to send reports. It builds on those two by also requiring the authenticated domain to align with the visible sender.
What does p=none actually do?
Nothing protective. It puts DMARC in monitoring mode: receivers still deliver failing mail as normal and simply send you reports. It is a reasonable first step while you gather data, but a domain left at p=none indefinitely gains no enforcement.
Should I use quarantine or reject?
Quarantine sends failing mail to the spam folder, reject blocks it outright. Move from none to quarantine once your reports show legitimate mail is passing, then to reject once you are confident. Jumping straight to reject risks losing real mail from sources you have not yet authorised.
What is the rua tag for?
It is the address where aggregate reports are sent, usually daily, summarising which sources sent mail as your domain and whether they passed. Without it you are enforcing a policy blind, so it should be set before you tighten beyond p=none.
What does DMARC alignment mean?
The domain authenticated by SPF or DKIM has to match the domain in the visible From address. A message can pass SPF for a completely different domain and still fail DMARC, which is exactly the spoofing case DMARC is designed to catch.
Why does my DMARC record not seem to apply?
Check that it is published at _dmarc.yourdomain.com rather than on the domain itself, that there is exactly one such record, and that the v=DMARC1 tag comes first. A record in the wrong place is simply never read.

Related Tools

Also Available As