DMARC Record Checker

Free online tool · DNS-over-HTTPS live lookup · runs in your browser, no data upload

DMARC (Domain-based Message Authentication, Reporting & Conformance, RFC 7489) builds on SPF and DKIM. Via the DNS _dmarc.<domain> record it declares the domain’s mail handling policy and receives authentication result reports from external mail systems (rua aggregate reports, ruf failure reports). Gradual DMARC deployment (p=none → quarantine → reject) is an internationally accepted practice; querying a DMARC record quickly tells you whether a domain is protected.

Enter a domain (e.g. example.com); the tool queries the TXT record at _dmarc.example.com (where DMARC records always live).

Features

  • Standard location: always queries the TXT record at _dmarc.<domain>, per RFC 7489
  • Full tag parsing: v/p/pct/rua/ruf/sp/fo/adkim/aspf explained, including policy percentage and subdomain policy
  • Policy strength rating: none (monitor only) / quarantine / reject
  • Alignment check: shows adkim/aspf alignment modes (relaxed r / strict s) and DKIM/SPF alignment requirements

How to Use

DMARC records always live at _dmarc.. Enter the domain and click check; the tool runs a DoH TXT query at that location and parses every tag. Pay attention to the p tag (policy) and rua tag (report address). If “No DMARC record found” is returned, the domain has no DMARC — any mail claiming to be from it cannot be blocked by DMARC validation. If p=none, it is only in monitoring mode; consider tightening gradually to quarantine/reject.

Why Check Regularly

DMARC (Domain-based Message Authentication, Reporting and Conformance, RFC 7489) builds on SPF and DKIM. It defines how receivers should handle mail when authentication fails, and how results are reported to the domain owner.

A domain without DMARC gives up control over spoofed mail — attackers can impersonate your domain for phishing while receivers have no unified policy to block it. The p=none / quarantine / reject tiers are designed exactly for gradual deployment.

When checking DMARC, besides the policy tags (p / sp), verify the rua/ruf report addresses are valid (invalid addresses lose reports), pct matches your deployment phase, and alignment modes (adkim/aspf) match your actual SPF/DKIM setup.

Interpreting Results

TagMeaningRisk Note
p=noneMonitor only; no action taken; mail delivered as usualLow (initial deployment)
p=quarantineMail failing authentication goes to spamMedium
p=rejectMail failing authentication is rejectedHigh (ensure config is correct)
sp=Subdomain policy; covers DMARC handling for subdomainsMedium
rua=Aggregate report address (must be a valid mailbox)Medium
pct=Policy application percentage (1-100) for gradual rolloutLow

Common Misconfigurations & Fixes

  • No DMARC record：Start with p=none; watch reports for 1-2 weeks to confirm no legitimate mail is affected
  • Invalid rua address：Ensure the report mailbox exists and can receive mail, otherwise no authentication stats
  • adkim/aspf alignment failure：Ensure the DKIM signing domain matches the From domain (relaxed) or exactly matches (strict)
  • p=reject false positives：Confirm SPF/DKIM pass rates (via rua reports) before escalating the policy
  • pct underused：Start at pct=10 for gradual rollout, increase after reviewing reports, then 100%

Technical Standards

This tool follows the IETF standards below; lookup and parsing logic match the RFC definitions:

  • DNS lookup: RFC 8484 (DNS Queries over HTTPS), RFC 1035 (DNS protocol)
  • Record parsing: DMARC: RFC 7489 §6 (DNS record), §6.3 (tag definitions)