Skip to content
tlspeek

DMARC

DMARC checker

Read the policy receivers are asked to apply when mail fails DMARC, where reports go, and whether the record is strict, partial, or missing.

Enter a domain. The lookup reads _dmarc in public DNS and does not keep the name.

Need a record to publish? Use the DMARC generator. It does not send the form anywhere.

DMARC is a TXT record at the name _dmarc on a domain. It tells receivers what to do when a message claims to be from that domain but fails authentication, and where to send reports about those messages. SPF and DKIM check a server or a signature. DMARC checks whether that result aligns with the domain a person sees in the From header, and then applies a policy: none, quarantine, or reject.

Alignment is the part people skip. SPF or DKIM can pass for a domain that is not the one in the From header. DMARC only counts a pass that lines up with that visible domain. Relaxed alignment allows a subdomain. Strict alignment requires an exact match.

How to read the tags

p is the policy for the domain itself. none means deliver the mail and, if you asked, send reports. quarantine means treat a failure as suspicious, which often lands the message in spam. reject means refuse it. sp is the same choice for subdomains and defaults to p when it is omitted. pct is the percentage of failing mail the policy applies to. It defaults to 100. A lower number is a rollout dial, not a permanent setting. pct=0 applies the policy to nothing.

rua lists mailboxes that should receive aggregate XML reports, usually once a day. Those reports are how you learn which servers send mail as you before you tighten the policy. If the mailbox is on another domain, that domain has to publish its own TXT record authorizing yours, or the reports are dropped. ruf asks for per-failure copies. Many receivers never send them, and the copies can contain message content, so most domains rely on rua. adkim and aspf choose strict or relaxed alignment for DKIM and SPF. Both default to relaxed.

How the grade is decided

The grade is a reading of the published tags, not a promise about deliverability. Grade A means p=reject, coverage of every message (pct omitted or 100), and at least one rua address. Grade B means reject with only partial coverage or no report address, or quarantine with a report address. Grade C means quarantine without reports, or none with reports. Grade D means none without reports, or any policy with pct=0. Grade F means the record is missing, invalid, or published twice. Two DMARC records are a permanent error. Receivers do not pick one.

Common mistakes

  • Leaving p=none in place for months. Monitoring is the right first step and a weak place to stop. Spoofed mail is still delivered.
  • Publishing reject before SPF or DKIM actually aligns with the From domain. Your own mail fails the policy you just asked the world to enforce.
  • Pointing rua at a mailbox that bounces, or at another company's domain that has not authorized you. You then have a strict policy and no reports.
  • Setting pct to a small number and forgetting it. Most of your failing mail never sees the policy you think you published.
  • Adding a second _dmarc TXT record while editing. The pair is invalid even if each line would have been fine alone.

This checker fetches the TXT record at _dmarc and explains the tags. It does not log into a mailbox, parse a report archive, or send a test message. The generator on the next page builds a record in the browser and does not send the form anywhere.

FAQ

Does a DMARC record by itself stop spoofing?

No. Receivers need a passing and aligned SPF or DKIM result to accept mail under a strict policy. The DMARC record only says what to do when that authentication is missing or does not align.

Should I start at reject?

Start at p=none with rua pointed at a mailbox you read. Move to quarantine, then reject, after the reports show that your real senders align. Jumping straight to reject is how newsletters and password resets disappear.

What does a grade B quarantine record mean?

The domain asks receivers to treat failures as suspicious and it requests reports. That is a solid intermediate policy. It is not the strictest one, which is why it is not an A.

Why might reports never arrive?

The rua mailbox may be rejecting the messages, or it may sit on a domain that has not published an authorization record for yours. Also confirm there is only one DMARC record and that it is valid.

Are subdomain policies required?

sp is optional. When you omit it, subdomains use p. Set sp when a subdomain should be stricter or looser than the organizational domain, and publish a separate record on that subdomain if it needs its own rua address.