Free tool
DMARC record checker
Look up a domain's DMARC record, see the policy receivers will apply and what every tag means, and check where reports go.
What it checks
What this checker looks at.
- Reads the TXT record at _dmarc.domain and keeps only records whose first tag is v=DMARC1, the same rule receivers use.
- If the domain has no usable record, looks up its organizational domain's record, as receivers do, and applies that record's sp tag to the subdomain.
- Validates every tag value and lists each tag with its meaning, including the defaults for tags you left out.
- Works out the policy that applies, and how a pct below 100 changes it.
- Flags report addresses in rua and ruf that are not mailto:, and for mailto: addresses in rua on another domain, checks that the receiving domain has published the record that authorizes them.
- It reads TXT records only. It does not read your reports or test whether your mail passes DMARC.
Common problems
How to fix what it finds.
Start with p=none and a report address
Publish v=DMARC1; p=none; rua=mailto: followed by an address you read. The aggregate reports show every source sending as your domain and whether it passes.
Move to quarantine, then reject
Once the reports show your own mail passing SPF or DKIM with an aligned domain, change p to quarantine and later to reject. The pct tag lets you apply the policy to part of the failing mail first.
Keep one record per name
Two DMARC records at the same name make receivers ignore DMARC for the domain. Edit the existing record instead of adding another.
Authorize reports to another domain
A report service on a different domain has to publish a record at yourdomain._report._dmarc.theirdomain. Ask the service to publish it if this check says it is missing.
- More than one DMARC recordKeep one record that starts with v=DMARC1 and delete the others.
- v=DMARC1 is not the first tagMove v=DMARC1 to the very start of the record, as in v=DMARC1; p=none.
- Missing or invalid p tagAdd p=none, p=quarantine or p=reject right after v=DMARC1.
- Policy is noneRead the aggregate reports until every legitimate source passes, then move to p=quarantine and later p=reject.
- Invalid tag valueCorrect the value using the allowed values for that tag: sp takes none, quarantine or reject, adkim and aspf take r or s, pct takes a number from 0 to 100, and rua and ruf take a comma-separated list of URIs.
- Policy applies to part of the mailRaise pct step by step to 100, or remove the tag, once the reports show your legitimate mail passing.
- No aggregate report addressAdd rua=mailto: followed by an address that you or your report service reads.
- Report address not authorizedAsk the owner of the report address to publish that record, or send reports to an address on your own domain.
- Report address is not mailto:Add or switch to a mailto: address that you or your report service reads.
- Record found at the organizational domainNothing is required. Publish a record at the subdomain itself only if it needs a different policy.
Try it on the free plan.
1,000 emails a month free, no card. Pro is $29 a month for 50,000.