Passed
A single valid DMARC record was found and the specific control meets the checker’s criteria. Continue monitoring reports and sender changes.
Check your DMARC record
Find the public DMARC policy for a domain and review its enforcement, coverage, alignment and reporting settings.
- No account required
- Public DNS records only
- Clear remediation guidance
What is a DMARC record?
DMARC—Domain-based Message Authentication, Reporting and Conformance—is an email authentication policy published as a TXT record at _dmarc.yourdomain.com. It tells receiving mail systems what to do when a message claiming to come from your domain fails SPF or DKIM alignment.
A complete DMARC deployment combines authentication with policy and reporting. SPF and DKIM establish whether a sender is authorized; DMARC checks whether the authenticated domain aligns with the address people see in the From field. Aggregate reports can then show which services send on your behalf and where unauthenticated traffic originates.
Publishing a DMARC record is important, but the policy matters. A monitoring policy of p=none collects evidence without asking receivers to block mail. Quarantine and reject policies provide progressively stronger protection after every legitimate sender has been identified and authenticated.
How the checker works
- 01
Normalize the domain
The checker removes URL paths and queries the organizational domain you submit.
- 02
Read public DNS
It looks up the TXT record at _dmarc.yourdomain.com using public DNS evidence.
- 03
Evaluate the policy
The record is checked for syntax, enforcement, coverage, reporting, alignment and subdomain handling.
- 04
Prioritize changes
Results separate failures from recommendations and explain the safest next step.
How to read DMARC results
Recommended
The record works but could provide stronger coverage—for example, p=none, partial pct coverage, or no aggregate reporting destination.
Failed
No valid record, multiple DMARC records, or a material policy problem was detected. Protection may be absent or unpredictable.
Unverified
A dependent lookup could not be completed. Rerun the check before changing DNS; an unavailable resolver response is not treated as failure.
Common DMARC problems and fixes
No DMARC record
Start with one TXT record at _dmarc. Use p=none while inventorying senders, add a monitored rua mailbox, and review reports before enforcing.
More than one record
DMARC permits one policy record. Merge the required tags into a single record and remove duplicates from the authoritative DNS zone.
Policy never moved beyond monitoring
After legitimate sources pass aligned SPF or DKIM, progress deliberately to quarantine and then reject. Monitor delivery at every stage.
Subdomains are unprotected
Set an sp policy when subdomains need explicit treatment. Confirm first that applications sending from subdomains authenticate correctly.
Frequently asked questions
Practical answers about this checker and the signal it evaluates.
Does DMARC stop all spoofing?+
DMARC substantially reduces direct-domain spoofing when receivers enforce it, but it does not prevent lookalike domains, compromised accounts or every display-name attack. It should be combined with account security, filtering and domain monitoring.
Can I publish p=reject immediately?+
Only when you have a reliable sender inventory and verified alignment for every legitimate service. Moving too quickly can cause valid mail to be rejected, including messages from overlooked billing, support or marketing platforms.
What are SPF and DKIM alignment?+
Alignment means the domain authenticated by SPF or DKIM matches, or is an allowed subdomain of, the visible From domain. DMARC passes when at least one aligned authentication method passes.
How long do DMARC DNS changes take?+
Changes may appear quickly, but cached answers remain until their TTL expires. Allow for the record’s previous TTL and verify against the authoritative DNS provider before assuming a change failed.