DMARC Record Parser
Paste a DMARC record to see every tag explained in plain English.
Understand any DMARC record
DMARC records pack a lot into a short string of tags. Paste any v=DMARC1 record and this parser breaks out each tag - policy (p), subdomain policy (sp), percentage (pct), reporting addresses (rua/ruf), and alignment modes (aspf/adkim) - and explains what each one does.
Use it to audit your own record or to understand another domain's DMARC posture. This runs entirely in your browser - nothing is uploaded.
The tags it explains
A DMARC record is just these tags, separated by semicolons. Here's what the parser breaks out.
| Tag | Meaning |
|---|---|
| p | Domain policy: none (monitor), quarantine (spam), or reject (block). |
| sp | Subdomain policy. Inherits p if omitted. |
| pct | Percent of failing mail the policy applies to. Default 100. |
| rua / ruf | Addresses for aggregate (daily XML) and forensic (per-message) reports. |
| adkim / aspf | Alignment mode for DKIM / SPF: r relaxed (default) or s strict. |
What to look for when you read a record
Start with p. A record sitting at p=none is only monitoring - it provides no protection against spoofing, so if you see it on a domain that's been live for a while, that's the finding. quarantine and reject are the enforcing policies.
Then check rua: no aggregate report address means the domain owner is flying blind with no visibility into who sends as them. Finally note the alignment tags - strict alignment (s) is stricter than most senders need and can cause legitimate mail to fail, so relaxed (the default) is usually correct.
Frequently asked questions
What are the main DMARC tags?
p (policy), sp (subdomain policy), pct (percentage enforced), rua/ruf (aggregate and forensic report addresses), and aspf/adkim (SPF and DKIM alignment modes: relaxed or strict).
What does sp do?
sp sets a separate policy for subdomains. If omitted, subdomains inherit the main p policy.
What does p=none mean when I read a record?
It means the domain is only monitoring - failing mail is still delivered and the owner just collects reports. It offers no spoofing protection, so a long-lived domain still at p=none has an incomplete DMARC setup.
Is this different from the DMARC checker?
The DMARC checker looks up a domain's live record from DNS; this parser explains a record you paste in. Use the parser to understand a record you already have or found, without a DNS lookup.
Next steps
Stop configuring DNS by hand
Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.