DMARC Record Checker
Look up a domain’s DMARC policy and see how strictly it is enforced.
The domain to look up
How this lookup works
DMARC is published as a TXT record at _dmarc.yourdomain. It tells receiving mail servers what to do with mail that fails SPF and DKIM checks. This tool retrieves that record so you can read the policy. Note: enter the domain, and the tool queries its _dmarc record.
What the results mean
- p=none
- Monitor only — failing mail is still delivered. The right first step, but it protects nothing on its own.
- p=quarantine
- Failing mail is sent to spam. Partial protection.
- p=reject
- Failing mail is rejected outright. Full protection against domain spoofing, and the goal to work toward.
Common problems and fixes
- The record is published but no reports arrive
- Check the rua tag holds a valid address, and that it is monitored — aggregate reports are XML attachments sent daily and are easy to miss in a shared mailbox. If the reporting address is on a different domain from the one being reported on, that domain must publish an authorisation record permitting it, or reporters will refuse to send.
- Legitimate mail is failing DMARC despite passing SPF
- Alignment, which is the part people miss. DMARC requires the domain that passed SPF or DKIM to match the visible From domain. A bulk sender whose bounce address is on their own domain passes SPF for that domain and fails alignment for yours — which is why they ask you to set up a custom return path.
- The record looks correct but is being ignored
- Check where it is published. DMARC lives at _dmarc.example.com as a TXT record, not on the domain itself, and a record placed on the bare domain is invisible to every receiver. Also confirm there is only one — multiple DMARC records for a name make the policy invalid, and receivers skip it entirely.
Frequently asked questions
What DMARC policy should I have?
The destination is p=reject, which stops anyone spoofing your domain. But get there in stages: start at p=none to collect reports without affecting delivery, confirm your legitimate mail passes SPF and DKIM, then move to quarantine and finally reject. Jumping straight to reject risks blocking your own mail.
What is the pct tag for?
It applies the policy to a percentage of failing mail rather than all of it, which is how a staged rollout works in practice. Moving to p=quarantine with pct=10 affects a tenth of failures, so a mistake in your alignment shows up in the reports before it affects most of your mail. Raise it gradually once the reports are clean.
Does DMARC stop people spoofing my domain?
At p=reject it stops mail claiming to be from your domain arriving at receivers that honour DMARC, which is most large providers. It does not stop lookalike domains, display-name spoofing, or a compromised account sending genuinely authenticated mail. It closes one specific and widely abused route, not impersonation in general.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/dmarc-checker/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="DMARC Record Checker" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/dmarc-checker/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.