DMARC Checker
Finds your DMARC record, or the parent domain's for a subdomain, reads its policy, sp=, pct=, rua= and alignment tags, and tells you whether the policy is enforced and your reports can arrive.
@emailens/engine 0.17.2 · data last changed 27 Oct 2026
Example: example.com, a made-up domain with a sample DMARC record. Check yours above.
passexample.com
DMARC enforced with policy p=quarantine (100% coverage).
Unauthorized emails claiming to be from example.com will be quarantined by compliant inboxes.
TXT _dmarc.example.com
v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=r
Policy
Pass: Enforced
The policy that applies is quarantine or reject, on 100% of failing mail.
Tags
- p=quarantine
- Failing mail goes to spam or quarantine.
- sp=reject
- For subdomains without their own record. Failing mail is refused outright.
- pct=100
- The policy applies to all failing mail.
- rua=mailto:dmarc@example.com
- Aggregate reports go to an address on your own domain.
- adkim=s
- DKIM alignment, strict: the domain must match the From domain exactly. r is the default when the tag is left out.
- aspf=r
- SPF alignment, relaxed: a domain that shares the From domain's organizational domain aligns (mail.acme.com with acme.com). r is the default when the tag is left out.
Change a tag in the DMARC record generator, or read what your reports say in the DMARC report reader.
Authenticated mail still has to look right when it lands. Open the checker and paste its HTML: five clients, no account.
No signup · Five clients free, Outlook Classic included · All 21 with an account
Which clients need an account
Gmail Android, Gmail iOS, Outlook 365, Outlook iOS, Outlook Android, Outlook for Mac, Apple Mail, Yahoo Mail Android, Yahoo Mail iOS, Samsung Mail, Thunderbird, HEY Mail, Proton Mail, AOL Mail, Fastmail, Superhuman open with a free account.
The checker needs a computer screen.
What each check reads
- Record
- Reads the TXT records at _dmarc on your domain that start with v=DMARC1. On a subdomain with none, it reads the organizational domain's record instead, as receivers do. None is a fail; more than one is treated as none.
- Policy
- Reads p=, sp= and pct=. A subdomain using its parent's record gets sp= when it is set. The policy that applies must be quarantine or reject at pct=100 to count as enforced; p=none or a lower pct is a warning.
- rua
- Checks a reporting address is set. When the first mailto: address is on another domain, looks up the authorization record that domain must publish, yourdomain._report._dmarc.theirdomain.
- Alignment
- Reads adkim= and aspf=, relaxed (r, the default) or strict (s).
The record says what should happen; the reports say what did. How to read a DMARC report walks through one, and the DMARC report reader reads yours. To change the record, use the DMARC record generator.
Your next question
- Is my SPF record under the 10-lookup limit?
- Is my DKIM key published, and is it strong enough?
- Check SPF, DKIM, DMARC, MX and BIMI at once.
- How do I get from p=none to p=reject safely?
- How do subdomains inherit DMARC?
Other free tools: BIMI Checker · DMARC Report Reader · DMARC Record Generator · Email Header Analyzer · Email Spam Checker
Run this check on every email
A free account re-checks your records every day (1 monitored domain) and emails you when one changes: Watch your domain daily, free.
SPF, DKIM and DMARC monitoring (Dev). Dev is $9 a month. For one developer: 100 checks a day, an API key and a test inbox. See the plans →
Questions
What does a DMARC checker check?
This one finds the v=DMARC1 record at _dmarc on your domain (or the parent domain's, for a subdomain without one), flags duplicate records, reads the policy (p=), subdomain policy (sp=), pct=, the rua= reporting address and the adkim= and aspf= alignment modes, and tells you whether the policy is enforced. For a reporting address on another domain it checks that domain authorizes the reports.
What do p=none, p=quarantine and p=reject do?
p=none only asks for reports: failing mail is delivered as usual, so it doesn't stop spoofing. p=quarantine sends failing mail to spam, and p=reject refuses it. The safe path is to start at p=none, read the reports until every legitimate sender passes, then move to quarantine, ramp pct= up to 100, and finish at reject.
What does sp= do in a DMARC record?
sp= sets the policy for subdomains that have no DMARC record of their own. Left out, subdomains get p=. A subdomain that publishes its own record at _dmarc.sub.yourdomain uses that instead. Setting sp=reject while p= is still none blocks spoofed subdomains while you keep monitoring the main domain.
Why do my DMARC reports go to another domain, and is that allowed?
Report services ask you to send rua= to an address on their domain. RFC 7489 lets that domain receive your reports only if it publishes a TXT record at yourdomain._report._dmarc.theirdomain containing v=DMARC1. Without it, receivers may not send the reports. This checker looks that record up.
What is the difference between relaxed and strict alignment?
Alignment compares the From domain with the domain SPF or DKIM authenticated. Relaxed (r, the default) accepts any domain that shares the organizational domain, so mail.acme.com aligns with acme.com. Strict (s) wants an exact match. adkim= sets it for DKIM and aspf= for SPF.