DMARC checker
Type a domain to read its DMARC policy and see what Gmail, Outlook and Yahoo are told to do with mail that fakes it. Free, no account.
Every record is checked in the same pass. Also: SPF record checker, DKIM checker, MX record lookup. Full domain check.
What a DMARC record says
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do with a message whose From line uses your domain but which passes neither SPF nor DKIM for that domain, and where to send reports about it.
_dmarc.yourdomain.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
The three policies, in the order to use them
p=none: nothing is blocked, receivers only send reports. The right first step, for about two weeks while you check that every service sending as you passes.
p=quarantine: failing mail goes to spam. Move here once the reports show only your own services, all passing.
p=reject: failing mail is refused. The end point, and the one that actually stops someone from sending as you.
What the checker flags
No record at all, more than one record, no rua address to receive reports, a policy inherited from the parent domain, and the step the policy is at. Each comes with what to do next.
Questions
What does DMARC p=none mean?
Receivers report on mail that fails authentication but deliver it as usual. It is the monitoring step: useful for two weeks or so, then move to p=quarantine and later p=reject. A domain left at p=none can still be spoofed.
Do I need DMARC to send to Gmail and Yahoo?
Since February 2024, Gmail and Yahoo require a DMARC record from bulk senders, about 5,000 messages a day or more to their users. p=none satisfies the requirement. Smaller senders are not required to have one but are treated better with it.
What is DMARC alignment?
DMARC passes when SPF or DKIM passes for the same domain as the From line. adkim and aspf set how strict the match is: relaxed (the default) accepts a subdomain, strict requires the exact domain.
Does the DMARC policy apply to subdomains?
Yes, unless the record sets sp= for subdomains. A subdomain can also publish its own _dmarc record, which then takes precedence for that subdomain.
Reads public DNS only. A DKIM key we cannot find is reported as not determined, never as an error. Results are kept for ten minutes.