DMARC Record Checker
?About this tool, how to use it, and FAQ▾
What is a DMARC record checker?
DMARC ties SPF and DKIM together: it tells receivers what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it. This checker fetches _dmarc.yourdomain from DNS and breaks down the policy (none, quarantine, or reject), the subdomain policy, SPF and DKIM alignment modes, the enforcement percentage, and the aggregate (rua) and forensic (ruf) reporting addresses.
Compliance checks flag the common gaps — a policy stuck at p=none, missing report addresses, or a pct below 100 that leaves spoofed mail flowing.
How to use
- Enter your domain to fetch its _dmarc record.
- Check the policy tag: p=none only monitors, quarantine sends failures to spam, reject blocks them outright.
- Confirm rua= points at a mailbox or service that actually processes aggregate reports.
- Move from none to quarantine to reject as your reports show legitimate mail passing.
Frequently asked questions
What is the difference between p=none, quarantine, and reject?
p=none asks receivers to deliver normally and just send you reports — monitoring mode. p=quarantine asks them to treat failures as suspicious (usually spam-foldered). p=reject asks them to refuse failing mail entirely, which is the end goal of a DMARC rollout.
What does DMARC alignment mean?
SPF and DKIM each authenticate a domain, but not necessarily the one in the From header a user sees. DMARC requires at least one of them to align with the From domain — relaxed mode allows subdomains, strict mode requires an exact match (the adkim and aspf tags).
Do I need both SPF and DKIM for DMARC to pass?
No — DMARC passes if either SPF or DKIM passes with alignment. Publishing both is still strongly recommended because SPF breaks on forwarding while DKIM usually survives it.