Skip to content
MailTwin

DMARC record checker

Enter a domain to find its DMARC record, check every tag, and see whether spoofed email using the domain would be delivered, quarantined or rejected.

You can also paste a URL or an email address.

Try: , ,

What DMARC does

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc. plus your domain. It tells receiving mail servers two things: what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it.

A message passes DMARC when SPF or DKIM passes and the domain that passed matches the domain in the visible From address. That match is called alignment, and it is what stops an attacker from passing SPF with their own domain while showing yours.

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

What the checker looks at

  • Discovery. If the exact name has no record, receivers fall back to the organisational domain (for mail.example.com, that is example.com). The checker shows which record actually applies.
  • Policy. p=none only monitors, p=quarantine sends failing mail to spam, p=reject refuses it.
  • Subdomains. sp= sets the policy for subdomains, and the new np= tag (RFC 9989) covers subdomains that do not exist. sp=none under a reject policy leaves every subdomain open to spoofing.
  • Reporting. rua= addresses receive daily aggregate reports. If an address is on a different domain, that domain must publish an authorisation record or receivers will not send to it. The checker tests that record for you.
  • Alignment. adkim and aspf choose relaxed (default, subdomains match) or strict (exact domain only).
  • Syntax. Unknown tags, invalid values, a missing v=DMARC1 at the start, and more than one record at the same name.

DMARC tags at a glance

TagMeaningNotes
vVersion, always DMARC1Must be the first tag.
pPolicy for the domainnone, quarantine or reject.
spPolicy for subdomainsDefaults to p.
npPolicy for non-existent subdomainsNew in RFC 9989. Defaults to sp, then p.
ruaWhere aggregate reports goComma-separated mailto: URIs.
rufWhere failure reports goFew large providers send these.
adkim, aspfAlignment moder relaxed (default) or s strict.
tTesting modeNew in RFC 9989. t=y asks receivers to apply one level less than the policy.
pctPercentage of failing mail the policy applies toHistoric in RFC 9989 and ignored by receivers that follow it. Older receivers still apply it.

Which policy should you have?

p=reject is the only setting that stops exact-domain spoofing, and it is what large mailbox providers, the UK NCSC and the Australian ISM (ISM-1540) point to. Getting there safely takes a few weeks of reading reports. The rollout guide covers each stage, and the checker tells you which stage you are at.

Google, Yahoo and Microsoft require bulk senders to publish DMARC (at least p=none) alongside SPF and DKIM. Monitoring is enough for those rules, but it does not stop anyone from sending mail as you.

DMARC needs SPF and DKIM underneath it

DMARC passes only if SPF or DKIM passes and aligns. Before enforcing, make sure every service that sends as your domain either signs with DKIM using your domain or sends from a Return-Path on your domain. Check the SPF side with the SPF checker.