Patchkit

Free tool

DMARC Checker

Look up any domain's DMARC record, see what its policy really does, and get the exact fix for every problem.

What your DMARC record tells receivers

DMARC connects the two technical checks, SPF and DKIM, to the address people actually see in the From line. A message passes DMARC when at least one of them passes and is aligned with the From domain. Your record then tells receivers what to do with mail that fails, and where to send reports about it.

  • p= is the policy: none monitors, quarantine sends failures to spam, reject blocks them.
  • rua= lists where daily aggregate reports are sent. Without it you're flying blind.
  • pct= applies the policy to a share of failing mail, which is useful while rolling out enforcement.
  • adkim= and aspf= choose relaxed or strict alignment. Relaxed is the right default for almost everyone.

The safe path to p=reject

Jumping straight to p=reject can block your own invoices or newsletters if a service you use isn't set up yet. Start with p=none and a report address, read the reports until every legitimate sender passes, then step up through quarantine with a rising pct before switching to reject.

Need a record? Build one with the DMARC generator, or run a full domain health check to see SPF, DKIM and DMARC together.

Frequently asked questions

+What does a DMARC checker do?

It reads the TXT record published at _dmarc.yourdomain.com, parses each tag, and tells you whether receivers will actually enforce it. It also flags syntax mistakes, missing report addresses and report destinations that haven't authorized your domain.

+Is p=none enough to meet Google, Yahoo and Microsoft requirements?

For bulk senders the minimum requirement is a DMARC record, and p=none satisfies it. But p=none only monitors: spoofed mail using your domain is still delivered. Use it to collect reports, then move to quarantine and reject.

+Why does my subdomain show the DMARC record of my main domain?

If a subdomain has no DMARC record of its own, receivers fall back to the record on the organizational domain, and the sp= tag decides the policy. The checker shows when this happens.

+What does 'report destination not authorized' mean?

When DMARC reports go to a different company's domain, that domain must publish a TXT record like yourdomain.com._report._dmarc.theirdomain.com containing v=DMARC1. Without it, many receivers silently drop your reports.