DMARC check: test and understand your DMARC record
Check whether your domain has a valid DMARC record, which policy applies and where reports go – with every tag explained.
Check DMARC record
Enter the domain shown as the sender of your email, for example your-domain.co.uk.
Lookups run through the Quad9 DNS resolver (Switzerland). We keep the checked domain and an anonymised IP address for no longer than 30 days.
How DMARC works
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. The record sits as TXT at _dmarc.your-domain.co.uk and starts with v=DMARC1. It links SPF and DKIM to the sender address the recipient sees and decides what happens to email that fails this check.
The three policies
With p=none nothing happens; you only receive reports. p=quarantine sends suspicious email to the spam folder, p=reject does not accept it at all. Since 2024, Gmail and Yahoo require bulk senders to have a DMARC record. If you really want to protect your domain, you end up at quarantine or reject.
Reports and the way to reject
Via rua=mailto:…, receivers send you daily aggregate reports: which servers sent in your name and whether SPF and DKIM passed. Start with p=none and reports, add missing senders to SPF and DKIM and then tighten step by step, for example via quarantine with pct=25 up to reject.
Common DMARC mistakes
Stuck on p=none
Many set DMARC to none once and forget about it. Then the record does not protect against forged email. Evaluate the reports and tighten the policy.
No report address
Without rua you never learn who sends in your name and cannot safely switch to reject. Add an address or a DMARC service.
Reports to another domain without authorisation
If reports go to another domain, that domain must agree with a record your-domain.co.uk._report._dmarc.other-domain.com. Without it, receivers discard the reports.
Record in the wrong place
The DMARC record belongs at _dmarc.your-domain.co.uk, not on the domain itself. And there must be only one.
Frequently asked questions
Enter your domain above. The DMARC check reads the record at _dmarc, explains every tag and checks the report addresses as well as the SPF record.
Start with p=none and a report address to see who sends in your name. Once every legitimate sender passes SPF or DKIM, switch to quarantine and later to reject.
Yes. If a subdomain has no record of its own, the main domain's record applies. With sp= you can set a separate policy for subdomains.
rua receives daily aggregate reports, ruf reports on individual failed messages. Many large providers no longer send ruf reports for privacy reasons. What matters most is rua.
DMARC requires SPF or DKIM to pass and match the sender domain. Formally one is enough, but DKIM is more robust because it survives forwarding. Set up both. Use the DKIM check to test your DKIM key.
With pct you apply the policy to only part of your email, for example pct=25 for a quarter. This is handy for introducing quarantine or reject carefully. Without it, 100 applies.
