DMARC Checker

A DMARC record is a list of tag=value pairs separated by semicolons, and only two are required: v=DMARC1 first, then p with the policy. Everything else has a default. The full set defined in RFC 7489 is below, and our tool shows the same table filled in for the domain you check, marking which tags are set and which are running on their defaults.

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]; adkim=s; aspf=s"

Publish p=none with a rua address first. Nothing changes for your mail, and within a day or two the aggregate reports start arriving. They list every IP address that sent mail using your domain, whether it passed SPF and DKIM, and whether the result aligned with the From domain. Read them for two to four weeks, long enough to catch monthly invoices and other low-volume senders.

Fix every legitimate source that fails. Usually that means adding a vendor's include to SPF, turning on DKIM signing in the vendor's dashboard and publishing the key, or moving a system to send from a subdomain. When the reports show only spoofers failing, move to p=quarantine. Some people use pct=25 and raise it in steps, which is fine but slow. Once quarantine has run clean for a few weeks, publish p=reject. Google, Microsoft and most banks run p=reject.

Set sp at the same time. A domain at p=reject with sp=none, or with a forgotten subdomain that has no DMARC of its own, is still spoofable from that subdomain, and the reports for the parent domain will not show it.

SPF and DKIM each check a domain, but neither checks the From address a person sees. SPF checks the envelope sender. DKIM checks the d= domain in the signature. DMARC adds the missing link by requiring one of those two domains to align with the From domain. A message passes DMARC when SPF passes and aligns, or DKIM passes and aligns. One is enough.

Relaxed alignment (the default, adkim=r and aspf=r) accepts any domain in the same organisational domain, so a signature with d=mail.example.com aligns with a From address at example.com. Strict alignment (adkim=s and aspf=s) requires an exact match. Relaxed is right for most domains and lets vendors sign from a subdomain you delegate to them. Strict is worth it for a domain that sends only from its own servers and wants to close the subdomain gap completely.

Aggregate reports, requested with rua, are XML files that a receiver sends about once a day. Each one covers every message the receiver saw using your domain in that period, grouped by sending IP address, with counts and the SPF, DKIM and alignment results for each group. They contain no message content. Gmail, Yahoo, Microsoft and most other large receivers send them, and they are the reports the whole rollout is based on. The raw XML is hard to read at volume, and most people feed it to a reporting service.

Forensic reports, requested with ruf, are sent per failing message and include the headers and sometimes the body. Because that means forwarding message content to a third party, most large receivers, Gmail included, never send them. Setting ruf is harmless, but do not plan around receiving anything.

If your rua address is on a different domain than the one being checked, that domain has to opt in by publishing a TXT record named yourdomain.com._report._dmarc.theirdomain.com containing v=DMARC1. Reporting services set this up for you, and our tool points it out when the report domain differs.

In October 2023 Google and Yahoo announced shared requirements for anyone sending 5,000 or more messages a day to their users, enforced from February 2024. The list: publish a DMARC record (p=none is accepted), pass SPF and DKIM, have the From domain align with one of them, offer one-click unsubscribe with the List-Unsubscribe header and honour it within two days, and keep the spam complaint rate below 0.3% in Google Postmaster Tools. Microsoft applied the same set to Outlook.com from May 2025.

The reason is that receivers cannot tell a spoofed newsletter from a real one without alignment. Senders below the threshold are not exempt from the authentication parts in practice, because a domain with no DMARC is scored lower by the same filters. Publishing p=none costs nothing and satisfies the rule.

The record lives at the _dmarc label under the domain. For a subdomain that has no record of its own, receivers fall back to the organisational domain, so check both when a subdomain sends mail. The DNSX API returns the parsed record as JSON.

$ dig TXT _dmarc.example.com +short
"v=DMARC1; p=reject; rua=mailto:[email protected]"

$ curl -s https://api.dnsx.dev/email/dmarc/example.com | jq '.parsed.policy'