Prontuno
Pricing
AI

Appearance

Log in Request access
Tools

ToolsEmail authentication

Free DMARC record checker and policy lookup

A DMARC record tells receiving mail servers what to do with messages that fail SPF and DKIM checks. It is published as a TXT record at _dmarc.yourdomain.com. Enter your domain below to see your policy, alignment settings, and reporting address.

Background

What is a DMARC record?

A DMARC record is a DNS TXT record at _dmarc.example.com that tells receivers what to do with mail that fails authentication. DMARC passes only when SPF or DKIM passes for a domain that aligns with the visible From address. The record sets a policy of none, quarantine, or reject, and names where to send reports.

How to read the result

The p= tag sets what receivers should do with mail that fails DMARC. none only monitors, quarantine asks receivers to treat failures as suspicious, and reject asks them to refuse failures.

Receivers also apply their own rules, so the policy is a request, not a guarantee.

Coverage

What this tool checks

  • The TXT record at _dmarc.example.com
  • The policy for the domain (p=) and its subdomains (sp=)
  • SPF and DKIM alignment modes, relaxed or strict
  • Aggregate (rua=) and forensic (ruf=) reporting addresses
  • The percentage of mail the policy applies to, and the defaults used for missing tags

Step by step

How to move a DMARC policy to enforcement

  1. Publish p=none with an rua= address so receivers send aggregate reports.

  2. Review the reports for a few weeks and list every service that sends mail as your domain.

  3. Fix SPF or DKIM alignment for each legitimate service, and stop any sender you don’t recognize.

  4. Change the policy to p=quarantine and keep reviewing reports.

  5. When the reports show only legitimate mail passing, change the policy to p=reject.

Reference

DMARC record tags

Tag Meaning Default
v=DMARC1 Record version. It must come first. Required
p= Policy for the domain: none, quarantine, or reject. Required
sp= Policy for subdomains. Same as p=
adkim= DKIM alignment: r relaxed or s strict. r
aspf= SPF alignment: r relaxed or s strict. r
rua= Addresses that receive aggregate reports. None
ruf= Addresses that receive failure reports. None
pct= Percentage of failing mail the policy applies to. 100
fo= When receivers should send failure reports. 0

Troubleshooting

Common problems and how to fix them

No DMARC record
Publish a TXT record at _dmarc on the domain. Start with p=none and an rua= address so you can review reports before enforcing.
No reporting address
Add an rua=mailto: address. If the address is on another domain, that domain must publish a record that authorizes it to receive your reports.
SPF or DKIM passes but DMARC fails
Check alignment. The domain that passed SPF or DKIM must match the domain in the From address, exactly in strict mode or by organizational domain in relaxed mode.
Policy stays at none
Use aggregate reports to find every legitimate sender and fix its alignment. Then move to quarantine and finally reject.

Example

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
This policy asks receivers to quarantine mail that fails DMARC and to send aggregate reports to the listed mailbox.

FAQ

Questions about DMARC

When does DMARC pass?
DMARC passes when SPF or DKIM passes and the domain it authenticated aligns with the domain in the From address.
What is DMARC alignment?
Alignment compares the From domain with the domain authenticated by SPF or DKIM. Relaxed alignment accepts subdomains of the same organizational domain. Strict alignment requires an exact match.
What is a DMARC aggregate report?
An aggregate report is a daily summary from a receiver of the mail it saw from your domain and its authentication results. It helps you find legitimate senders and spot unauthorized use.
Where is the DMARC record published?
As a TXT record at _dmarc.yourdomain.com. Each domain can have only one DMARC record.

Keep checking

Related tools

  • Free SPF checker

    Validate a domain’s SPF policy, inspect mechanisms, and count DNS lookups.

  • Free DKIM checker

    Validate a DKIM public key by domain and selector, including algorithm, size, and revocation status.

  • Email header analyzer

    Inspect SPF, DKIM, and DMARC results, identify the sending IP, confirm reverse DNS, and trace the delivery path.

Sending with Prontuno?

Domain authentication

Set up SPF, DKIM, and DMARC.

About Domain authentication
Specifications
RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (opens in a new tab)