Free DMARC checker
DMARC Record Checker
Free, no sign-up. We only fetch the public URL you enter.
Short answer
Enter a domain above and the DMARC checker reads the TXT record at _dmarc.yourdomain.com and explains every tag: p (policy), sp (subdomain policy), pct (share of mail the policy applies to), rua and ruf (report addresses), adkim and aspf (alignment). It flags p=none, which protects nothing yet, and a missing rua, which means you receive no reports. A mature record reads like v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com. For your website, monitordefend checks uptime every five minutes.
- Free, no sign-up: every DMARC tag explained.
- Flags p=none and a missing rua reporting address.
- Check after setting up SPF and DKIM or changing the policy.
v=DMARC1 version p=quarantine failing mail goes to spam sp=reject subdomains: reject pct=100 applies to all mail rua=mailto:dmarc@myshop.com aggregate reports adkim=r; aspf=r relaxed alignment
This free DMARC checker reads the DMARC record of any domain in seconds and explains it in plain language. It confirms your policy (none, quarantine or reject), the alignment settings and the reporting addresses, and it flags the two weak spots found most often: a policy that only monitors and a record without an address for aggregate reports. Use it to protect your brand from email spoofing, to verify a policy change and to troubleshoot authentication problems.
What DMARC is
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is an email protection standard that builds on SPF and DKIM and answers two questions those methods leave open: what should a receiving mail server do when a message claiming to come from your domain fails authentication, and how does the domain owner find out?
The domain owner publishes the answer as a TXT record at _dmarc.domain. Receivers such as Gmail, Outlook and Yahoo read it for every message, apply the policy and send reports back to the addresses listed in it. Large mailbox providers today expect a DMARC record from anyone who sends mail in volume, and without one your domain is an easy target for phishing in your name.
How the DMARC checker works
Enter a domain such as example.com and start the check. The tool looks up the DMARC record published at _dmarc.example.com and presents it in a readable format, tag by tag, with a short explanation of what each value means for your mail.
- Email arrives From: shop@myshop.com
- SPF and DKIM Pass, and aligned with myshop.com?
- DMARC record Reads p= at _dmarc.myshop.com
- Decision Deliver, spam folder or reject
It then points out the configuration gaps that matter most in practice. A policy of p=none is reported, because it tells receivers to deliver failing mail as usual. A record without a rua tag is reported too, because without aggregate reports you cannot see who sends mail in your name and whether your legitimate mail passes.
- The complete DMARC TXT record of the domain
- Policy for the domain and for subdomains (p, sp)
- Percentage, reporting and alignment tags explained
- Warnings for p=none and a missing rua address
What a DMARC record looks like
A DMARC record is a list of tags separated by semicolons. Only two are required; the rest refine the behaviour.
- v=DMARC1 — version, always first
- p= — policy for the domain: none, quarantine or reject
- sp= — separate policy for subdomains; defaults to p
- pct= — percentage of failing mail the policy applies to, 100 by default
- rua= — address for daily aggregate reports
- ruf= — address for failure reports on individual messages
- adkim= and aspf= — alignment mode for DKIM and SPF, r (relaxed) or s (strict)
p=none, p=quarantine and p=reject
The policy is the heart of the record and sets the enforcement level. p=none monitors only: receivers deliver failing messages as if there were no DMARC, but they send you reports. p=quarantine asks receivers to treat failing mail as suspicious, which usually means the spam folder. p=reject asks them to refuse failing mail outright, so a spoofed message never reaches the inbox.
- p=none
Monitor only, collect reports - quarantine
Failing mail to the spam folder - reject
Failing mail is refused
Starting with p=none is sensible, because the reports show you which legitimate services you have forgotten in SPF or DKIM. Staying there forever is not; a domain with p=none is just as easy to spoof as one with no record. Once the reports look clean, move to quarantine, optionally with a lower pct, and then to reject.
DMARC alignment in plain English
SPF and DKIM on their own can pass for a domain that has nothing to do with the From address your recipient sees. Alignment closes that gap: DMARC only counts a pass when the domain checked by SPF (the envelope sender) or the domain that signed with DKIM (d=) matches the visible From domain.
Relaxed alignment, the default, accepts subdomains, so mail signed by news.example.com aligns with a From address at example.com. Strict alignment demands an exact match. Strict settings reduce spoofing a little further but require a cleaner sending setup; for most domains relaxed alignment with a reject policy is the practical goal. A message needs only one aligned pass, SPF or DKIM, to pass DMARC.
DMARC reports and the rua tag
rua= names the address, or the endpoint of a reporting service, that receives aggregate reports. Mailbox providers send them roughly once a day as compressed XML files listing every IP address that sent mail with your domain, how many messages it sent and whether SPF, DKIM and alignment passed. It is how you monitor who is sending mail for your domain.
ruf= requests failure reports about single messages. Few providers send them any more for privacy reasons, so rua is the tag that matters. If the address is on another domain than your own, that domain must publish an authorisation record, otherwise receivers will not deliver the reports. Because raw XML is hard to read, many teams forward rua to a DMARC report analyser.
When you should check DMARC
DMARC changes have a direct effect on delivery, so a check before and after every step is worth the few seconds it takes.
- After setting up SPF and DKIM for your domain
- When rolling out policy changes, especially to quarantine or reject
- If your brand is being spoofed or used for phishing
- When you stop receiving DMARC reports
- When mailbox providers flag sender requirements or bounce your mail
Why a DMARC record shows up but does not work
The most common cause is the wrong hostname: the record must sit at _dmarc.example.com, not on the domain itself and not at dmarc without the underscore. Typos in tags are next; a missing semicolon or a misspelled tag can make receivers ignore the record. Two DMARC records on the same name are invalid as well.
Even a perfect record cannot help if SPF and DKIM do not align with the From domain, for instance when a newsletter tool sends with its own domain in the envelope sender and signs with its own key. Set up a custom sending domain and DKIM for each service. And if reports never arrive, check that the rua address exists and accepts mail.
Email security and your website
monitordefend does not monitor DMARC or other DNS records; check your record here after each change. It watches the website on your domain instead, every five minutes for uptime and response time, and it emails you when something breaks.
Frequently asked questions
How do I move from p=none to p=reject safely?
Start with p=none and a rua address, then read the aggregate reports for a few weeks until every legitimate sender – your mail provider, newsletter tool, CRM, helpdesk and invoicing system – passes SPF or DKIM with alignment. Switch to p=quarantine, optionally with pct below 100 at first, watch the reports again and move to p=reject once no legitimate mail is affected. Skipping the monitoring phase is the most common reason real mail ends up in spam.
Does DMARC stop all phishing that uses my brand?
No. It protects your exact domain in the From address. Look-alike domains, display-name tricks and compromised accounts are outside its reach, so it is one layer of email security, not the only one.
How do I check if my domain has a DMARC record?
Run the DMARC checker above for your domain. If DMARC is configured, you will see the record published at _dmarc.yourdomain.com with every tag explained.
What do p=none, p=quarantine and p=reject mean?
They are enforcement levels. none monitors only, quarantine treats failing mail as suspicious and usually sends it to spam, and reject blocks failing mail.
Do I need SPF and DKIM before enabling DMARC?
Yes. DMARC relies on SPF or DKIM passing and aligning with the From domain to recognise legitimate mail. Without them, an enforcing policy would block your own messages.
What is DMARC alignment (aspf and adkim) in plain English?
Alignment checks whether the domain used by SPF or DKIM matches the visible From domain. Relaxed mode accepts subdomains, strict mode needs an exact match.
Where do DMARC reports go, and what is rua?
rua= is the address or service that receives aggregate DMARC reports. They show which servers send mail for your domain and what passes or fails.
Why does my DMARC record show up but still not work?
Common causes are the wrong hostname, typos in tags, missing SPF or DKIM alignment, or a reporting address that cannot accept reports.
Can I use DMARC on subdomains too?
Yes. Subdomains inherit the policy of the parent domain, or the sp= value if it is set, and you can publish a separate record at _dmarc.sub.example.com when a subdomain needs its own policy.