Home / DMARC Checker
DMARC Checker
Check any domain's DMARC record against the current standard, RFC 9989, with SPF, DKIM, MX and MTA-STS in the same report.
About DMARC Checker
A DMARC checker shows whether a domain tells receiving mail servers what to do with email that fails authentication. DMARC builds on SPF and DKIM: it asks that the domain in the visible From: address matches a domain that passed one of them, and it publishes a policy for messages that do not. Enter a domain to read its DMARC record tag by tag, see the policy that applies to subdomains, find out whether reports are being sent anywhere, and get a suggested next step towards a reject policy. The same report checks SPF, DKIM, MX, MTA-STS and BIMI, so you can see the whole email setup at once.
What this DMARC checker looks at
- The DMARC record itself, its syntax, and every tag: p, sp, np, t, adkim, aspf, rua, ruf and fo.
- Whether the policy protects the domain. Only quarantine and reject stop spoofing; none only collects reports.
- Inheritance. A subdomain without its own record uses its parent's, and the checker shows where the record was found.
- Tags that RFC 9989 removed, such as pct, which receivers following the new standard ignore.
- SPF, DKIM, MX, MTA-STS, TLS reporting and BIMI, so you can see what DMARC depends on.
DMARC tags explained
| Tag | Meaning | Default |
|---|---|---|
| p | Policy for the domain: none, quarantine or reject | none, if missing |
| sp | Policy for subdomains that exist | same as p |
| np | Policy for subdomains that do not exist (new in RFC 9989) | sp, then p |
| t | Test mode: y asks receivers to apply one level less than the policy (new in RFC 9989) | n |
| adkim, aspf | Alignment for DKIM and SPF: r (relaxed) or s (strict) | r |
| rua | Where to send daily aggregate reports | none |
| ruf | Where to send failure reports | none |
How to move to p=reject safely
- Publish
v=DMARC1; p=none; rua=mailto:followed by an address you read, and collect reports for a few weeks. - Find every service that sends as your domain in the reports, and make sure each one passes SPF or DKIM with your domain.
- Move to p=quarantine, watch the reports again, then move to p=reject.
Sources: RFC 9989 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM), RFC 8461 (MTA-STS), Google email sender guidelines.
Frequently asked questions
How do I check my DMARC record?
Enter your domain above. The checker reads the TXT record at _dmarc.yourdomain, explains every tag in plain English, and shows whether the policy actually protects you. If a subdomain has no record of its own, it shows the parent record that applies, the way RFC 9989 looks it up.
What does p=none, p=quarantine or p=reject mean?
They are the domain owner's request to receiving mail servers. p=none asks for no special treatment and is used while you collect reports. p=quarantine marks failing mail as suspicious, usually sending it to spam. p=reject says failures are not legitimate and asks receivers to refuse them. Only quarantine and reject stop people spoofing your domain.
Is DMARC required?
For bulk senders to Gmail, yes. Google requires anyone sending more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC, and a policy of p=none is enough to meet that rule. For everyone else it is strongly recommended, because without it anyone can send mail that claims to come from your domain.
What changed in RFC 9989?
RFC 9989, published in May 2026, replaces RFC 7489 as the DMARC standard. Records still start with v=DMARC1. It removes the pct tag, adds np for subdomains that do not exist and t for test mode, and finds the policy by walking up the DNS tree. This checker follows the new rules and flags tags that receivers now ignore.