DMARC Check
Find and parse a domain's DMARC policy record.
No results yet
Enter a domain above and press Run to start the check.
About the DMARC Check
DMARC Check locates and parses a domain's DMARC record, a TXT record published at the _dmarc subdomain and starting with v=DMARC1. It interprets the policy (none, quarantine, or reject), the alignment modes, and the reporting addresses for aggregate and forensic reports. DMARC builds on SPF and DKIM to tell receivers how to handle mail that fails authentication.
How to use
- Enter the domain whose DMARC policy you want to check.
- Run the check to read the TXT record at _dmarc.yourdomain.
- Review the policy, alignment settings, and rua reporting addresses.
Reading a DMARC record: the tags that decide what actually happens
The `p=` tag is the whole point of the record and the one most often left inert. `p=none` tells receivers to take no action and simply report — useful for the first weeks while you confirm your legitimate mail passes, useless as a permanent state. In our scan of the top 10,000 domains, 29.4% of all published DMARC records were still sitting at `p=none`, monitoring spoofing without ever blocking it.
`sp=` sets a separate policy for subdomains and is where a strict-looking record often leaks. A domain at `p=reject` with no `sp=` applies reject to subdomains too, but adding `sp=none` — sometimes done to unblock a forgotten marketing subdomain — reopens the exact hole the record was meant to close, and attackers do enumerate subdomains looking for it.
`pct=` is a rollout dial, not a setting to leave in place. `pct=50` applies your policy to half of failing messages and treats the rest as the next weaker policy, so `p=reject; pct=50` behaves as a mix of reject and quarantine. It is designed for stepping up gradually; a record that has read `pct=20` for two years is a rollout somebody abandoned.
Alignment is what makes DMARC stronger than SPF or DKIM alone. A message passes DMARC only if it passes SPF or DKIM *and* the domain that passed matches the visible From: domain. That is why a forwarded message can pass SPF for the forwarder while still failing DMARC — and why `aspf=r` versus `aspf=s` changes whether a subdomain counts as a match.
Frequently asked questions
- Where is the DMARC record published?
- DMARC is a TXT record at the _dmarc subdomain, for example _dmarc.example.com, and begins with v=DMARC1.
- What does the DMARC policy tag do?
- The p tag sets the action for failing mail: none monitors only, quarantine sends it to spam, and reject blocks it outright.
- What are the rua and ruf addresses?
- rua receives aggregate XML reports summarizing authentication results, while ruf receives forensic reports about individual failures, where supported.