DMARC checker

Look up a domain's DMARC record at _dmarc., check its policy and reporting address, and get a corrected record to copy. Free, no sign-up.

What this DMARC check tests

A record exists at _dmarc.yourdomain.com and starts with v=DMARC1. A DMARC record on the domain itself (without _dmarc.) is ignored by every receiver.
There is exactly one DMARC record. With two, receivers apply no DMARC policy at all.
The policy: p=none only monitors, so spoofed mail still gets delivered.
A reporting address (rua=), so you can see every service that sends as you. If the reports go to another company's domain, that domain must publish an authorization record. The checker looks it up.
Tags that were removed from the standard in RFC 9989 (May 2026), such as pct.

DMARC tags explained

`v`	Version. Must be the first tag and exactly `DMARC1`.
`p`	Policy for mail that fails DMARC: `none` (monitor only), `quarantine` (spam folder) or `reject` (refuse).
`sp`	Policy for subdomains. Without it, subdomains use `p`.
`np`	Policy for subdomains that don't exist (new in RFC 9989).
`rua`	Where receivers send daily aggregate reports, e.g. `mailto:dmarc@example.com`. Without it you can't see who sends as you.
`ruf`	Where to send failure (forensic) reports. Most large receivers never send them.
`adkim`	DKIM alignment: `r` relaxed (same organizational domain is enough) or `s` strict (exact domain).
`aspf`	SPF alignment for the Return-Path domain: `r` relaxed or `s` strict.
`fo`	When failure reports are generated (`0`, `1`, `d`, `s`).
`t`	Testing flag (RFC 9989): `t=y` asks receivers to apply one step softer while you test.
`pct`	Percentage of failing mail the policy applies to. Removed in RFC 9989: only 0 and 100 were ever applied consistently. Use `t=y` while testing.
`psd`	Marks a public suffix domain (RFC 9989). Leave it out on a normal domain.
`ri`	Report interval. Removed in RFC 9989; receivers report daily anyway.
`rf`	Failure report format. Removed in RFC 9989.

Roll out DMARC without blocking your own mail

Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Nothing changes for delivery yet.
For 1–2 weeks, read the reports (DMARC report analyzer or free monitoring). Every service that sends as you must pass SPF or DKIM aligned with your domain.
Fix the senders that fail (usually a newsletter tool, CRM or website form without DKIM for your domain).
Move to p=quarantine, then to p=reject once the reports stay clean.

Common DMARC problems

No DMARC record. Since 2024 Gmail and Yahoo require DMARC from bulk senders (5,000+ messages a day), and Microsoft Outlook.com since May 2025. Gmail answers 550 5.7.40 or 550 5.7.26; Outlook answers 550 5.7.515.
SPF and DKIM pass, DMARC still fails. They passed for another domain (your email service's), not yours. Set up DKIM with your own domain in that service: 550 5.7.32 explains alignment.
Stuck at p=none for months. It protects nothing. Use the reports to fix your senders, then enforce.
Reports go to an address nobody reads. The XML arrives daily. Send it to a tool that summarizes it.

Make a new record with the DMARC generator, or check SPF, DKIM and everything at once on the deliverability checker.

Rather have it fixed for you? I check your domain by hand and email you the exact SPF, DKIM and DMARC records for every service that sends your mail, with click-by-click steps for your DNS host. Then I re-check until they pass.

Get it fixed: $29

Pay by card, no account needed. Within 24 hours; not fixed, full refund. Prefer Fiverr? · Do it yourself with the Fix Kit ($15)

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Did this fix it?