One valid record
One record at _dmarc, starting v=DMARC1, with each tag written once. Two records, or a tag written twice, and receivers apply none of it.
DMARC checker
Check your DMARC record. Free, with no account.
Type in a domain. We read its DMARC record from public DNS and grade it as the Full Report does: whether it is valid, the policy it sets, whether subdomains are covered and whether its reports reach anyone.
Source: RFC Editor, RFC 9989.
- Reads only public DNS
- No account, nothing to install
- Checks SPF as well
What the DMARC checker looks at
The policy it sets
A policy of none watches and blocks nothing. Quarantine sends failing mail to junk and reject refuses it. A test-mode tag softens either.
Subdomains
The sp= tag sets the policy for subdomains. A subdomain with no record of its own is covered by its parent's, which the checker reads and names.
Where reports go
The rua= tag says where daily reports are sent. A mailbox at another company must publish a record agreeing to take them, or none arrive.
These are checks 4 and 10 on the scanner page, graded by the same rules as the free check and the Full Report.
Reading a DMARC record
DNS · TXT · _dmarc.yourcompany.co.ukExample
v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourcompany.co.uk
v=DMARC1 says this TXT record is a DMARC record. It must come first.
p=quarantine asks receivers to send mail that fails to junk. The other choices are none and reject.
sp=quarantine sets the same policy for subdomains.
rua=mailto:dmarc@yourcompany.co.uk is where the daily reports go.
What each policy does, and how we take a domain to reject without losing real mail: How DMARC works.
Questions
What is a DMARC record?
A TXT record at _dmarc on your domain. It tells receiving servers what to do with mail that claims to be from you but fails SPF and DKIM, and where to send reports about it.
How do I check my DMARC record?
Type your domain into the checker at the top of this page. It reads _dmarc from public DNS, as a receiving server does, and grades it. You need no account.
What does p=none mean?
Watch only, the stage we call Observe. Receivers deliver failing mail as normal and send you reports about it. It is the right place to start and the wrong place to stay, because it stops nothing.
What is the difference between quarantine and reject?
Quarantine asks receivers to treat failing mail as suspicious, usually by putting it in junk. Reject asks them to refuse it, so it never reaches the inbox at all.
What is rua in a DMARC record?
The address daily aggregate reports are sent to. They list every server sending mail as your domain and whether its mail passed. Without them you cannot tighten the policy safely.
Does a DMARC record on my main domain cover its subdomains?
Yes, unless a subdomain publishes a record of its own. The sp= tag sets the policy for subdomains, and without it the main policy applies to them too.
More free checkers
TXT · your domain
SPF checker
Reads the record that lists the servers allowed to send email as you, and counts the DNS lookups it costs.
Check SPFTXT · selector._domainkey
DKIM checker
Reads the public keys that prove your email was signed by you, on the common selectors or your own.
Check DKIMTXT · _mta-sts · policy file
MTA-STS checker
Reads the policy that asks senders to deliver mail to you only over an encrypted connection, and your TLS reporting.
Check MTA-STS
Start with the free check.
It reads your SPF, DKIM and DMARC records in about 30 seconds, and tells you where you stand today.