DMARC Record Checker
Look up your DMARC record, read your policy and alignment, and see whether your domain is actually protected from spoofing.
What is a DMARC record?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that ties SPF and DKIM together. It tells receiving servers what to do when a message fails authentication, and where to send reports about who is sending mail as your domain. Think of it as your domain's instruction manual for email security.
It's published at _dmarc.yourdomain.com and starts with v=DMARC1. Without it, even if you have SPF and DKIM, nothing instructs receivers to reject spoofed mail, and you get no visibility into abuse - phishing and brand impersonation stay trivial.
Since 2024, Gmail, Outlook and Yahoo require a DMARC record for bulk senders. Google's guidelines mandate it once you send more than 5,000 messages a day to Gmail. The record is checked in milliseconds on every message.
How DMARC works
DMARC runs after SPF and DKIM, using their results plus alignment to make one policy decision:
The three DMARC policies
The p= tag is the heart of your DMARC record. It controls what happens to mail that fails authentication.
p=none (monitor)
Collects reports but takes no action. A safe place to start, but it does not stop spoofing. Stay 2 to 4 weeks, then move on.
p=quarantine
Failing mail is sent to spam. Real protection with a safety net - a good target once your legitimate senders all pass.
p=reject
Failing mail is rejected outright and the recipient never sees it. The strongest posture, and where you want to end up.
Example DMARC records
A DMARC record is a set of semicolon-separated tags. Here are the common shapes, from monitoring to full enforcement.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comv=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@yourdomain.comv=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=sDMARC tag reference
Only v and p are required. rua is technically optional but without it you get no reports and no visibility, so always include it.
| Tag | Example | What it does |
|---|---|---|
| v | v=DMARC1 | Version. Must be DMARC1 and must come first. |
| p | p=reject | Domain policy: none, quarantine or reject. |
| sp | sp=quarantine | Subdomain policy. Inherits p if omitted. |
| rua | rua=mailto:dmarc@you.com | Where daily aggregate XML reports are sent. |
| ruf | ruf=mailto:af@you.com | Forensic per-message reports. Many providers don't send these. |
| pct | pct=50 | Percent of failing mail the policy applies to. Default 100. |
| adkim | adkim=s | DKIM alignment: r relaxed (default) or s strict. |
| aspf | aspf=s | SPF alignment: r relaxed (default) or s strict. |
How to roll out DMARC safely
Jumping straight to reject can block your own mail. Ramp up in stages - the whole process typically takes 6 to 12 weeks:
What is DMARC alignment?
DMARC only passes when SPF or DKIM is aligned - meaning the domain they authenticate matches the domain in the visible From header. A passing SPF check on a different envelope domain does not satisfy DMARC on its own.
Relaxed alignment (the default) lets subdomains match the organizational domain, so news.yourdomain.com aligns with yourdomain.com. Strict alignment requires an exact match. Most senders should leave alignment relaxed.
This is why some domains have SPF and DKIM yet still fail DMARC: the authentication passes, but not in alignment with the From address. Usually the fix is to have your provider DKIM-sign with your own domain. The checker above shows your policy and reporting so you can see where you stand.
SPF vs DKIM vs DMARC
The three records work as a team. SPF and DKIM are the locks; DMARC is the guard who decides what happens when a lock check fails.
SPF - who can send
Publishes the IPs authorized to send for your domain. Breaks on forwarding because the IP changes.
DKIM - message integrity
Adds a cryptographic signature proving the message wasn't altered. Survives forwarding.
DMARC - the policy layer
Ties SPF and DKIM together with alignment and tells receivers what to do when authentication fails.
Frequently asked questions
What is a DMARC record?
A DMARC record is a DNS TXT record at _dmarc.yourdomain.com that tells receiving servers what to do when a message fails SPF and DKIM, and where to send reports. It's the policy layer that makes SPF and DKIM enforceable.
What does p=none mean?
p=none is monitor mode - DMARC collects reports but takes no action on failing mail. It's a safe starting point but provides no protection against spoofing, so you should progress to quarantine and then reject.
What policy should I start with?
Always start at p=none for 2 to 4 weeks so you can read the reports and confirm which services legitimately send as your domain, without risking any real mail. Only tighten to quarantine and then reject once every legitimate sender passes.
Is p=reject safe to use?
Yes, once your legitimate senders all pass authentication in alignment. Move there gradually (none, then quarantine, then reject) so you don't accidentally block your own mail.
Why does my domain fail DMARC if I have SPF and DKIM?
Usually an alignment problem: SPF or DKIM passes, but on a domain that doesn't match your visible From address. DMARC requires alignment, not just a passing check. The common fix is to have the provider DKIM-sign with your own domain.
Can DMARC stop phishing?
It stops exact-domain spoofing - someone forging mail from your real domain. It does not stop lookalike domains (yourdomaln.com) or display-name spoofing, which don't use your domain at all, so DMARC is necessary but not sufficient on its own.
How do I read DMARC reports?
Add rua=mailto:you@domain to your record and you'll receive daily aggregate XML reports. They list which sources sent as your domain and whether they passed - use a DMARC report reader to make them human-friendly.
Do Google and Yahoo require DMARC?
For bulk senders, yes - both now require a DMARC record (at minimum p=none) plus SPF and DKIM. Enforcement policies like quarantine or reject are strongly recommended.
How long does DMARC take to work?
The DNS record itself is active within an hour or two of publishing. Aggregate reports begin arriving 24 to 72 hours later, and a full rollout from p=none to p=reject typically takes 6 to 12 weeks.
Next steps
Stop configuring DNS by hand
Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.