DMARC Checker

What the DMARC Checker looks at

DMARC lets you publish a policy at _dmarc.yourdomain telling receivers how to treat mail that claims to be from you but fails authentication. The current specification is RFC 9989 (May 2026), which obsoletes RFC 7489. Aggregate reports are now defined in RFC 9990 and failure reports in RFC 9991.

The checker:

• Finds the DMARC record at _dmarc.yourdomain. For a subdomain with no record of its own, it falls back to the parent domain's record.
• Fails a missing record, more than one record, or a missing or invalid p value, and checks that adkim and aspf are r or s.
• Grades the policy: reject and quarantine pass; p=none is a warning.
• Warns when testing mode (t=y) is on, when sp=none leaves subdomains open under a stricter p, and when pct is below 100 (RFC 9989 removed pct).
• Checks that a rua address is set and that report addresses on another domain are authorized (RFC 9990 §4).

How to read the results

• Pass. A valid record at p=quarantine or p=reject, with a working rua address.
• Warning. Valid, but not protecting you fully. Examples: p=none, t=y (test mode, which tells receivers to apply one level below your published policy), no rua, or sp=none under a stricter p.
• Fail. Missing, invalid or ignored. Examples: no record, more than one record, a record that doesn't start with v=DMARC1, or an invalid p value.
• Not tested. DNS didn't answer. Try again.
• Not applicable. We don't use this for DMARC. Every domain, including one that sends no mail, should publish a DMARC record.

What alignment means

DMARC passes when either of these is true:

• SPF passes, and the envelope sender domain aligns with the From domain.
• DKIM passes, and the signing domain (d=) aligns with the From domain.

"Relaxed" alignment (the default) accepts the same organizational domain, so news.example.com aligns with example.com. "Strict" (adkim=s, aspf=s) requires an exact match.

Common problems and fixes

No DMARC record. Start by monitoring:

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Stuck at p=none. Once your reports show all legitimate senders passing, move up:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Do this one step at a time, and publish only one of these at once. Our staged DMARC rollout guide has a timeline.

Two DMARC records. Receivers ignore DMARC entirely if they find more than one. Delete the extra.

Reports sent to another domain without authorization. If example.com sends reports to reports@example.net, then example.net must publish:

example.com._report._dmarc.example.net.  TXT  "v=DMARC1"

Domain that sends no mail. Use the strictest policy:

_dmarc.example.com.  TXT  "v=DMARC1; p=reject;"

Still using pct. Under RFC 9989, pct is gone. To soften a new quarantine or reject policy while you test, use t=y instead. Some receivers still follow RFC 7489, so the change in behavior may be gradual.

What the mailbox providers expect

Google (close to 5,000 messages a day) and Yahoo (bulk senders, no published threshold) require bulk senders to publish DMARC (at least p=none) and to pass it with aligned SPF or DKIM. Yahoo strongly recommends a rua address. Since November 2025, Google's sender guidelines FAQ has said it is ramping up enforcement, with temporary and permanent rejections for mail that doesn't meet the requirements.

Subdomains and parked domains

A DMARC record on example.com also covers its subdomains unless a subdomain publishes its own. Use sp to set a different policy for existing subdomains, and np for subdomains that don't exist, which attackers sometimes invent (billing.example.com). If you own parked domains that never send mail, give each one its own p=reject record; they're easy targets because nobody watches them.

Limitations

• The checker reads your published policy. It can't tell you which of your senders pass or fail; only DMARC aggregate reports show that.
• A strict policy is only safe once all legitimate mail passes. A Pass here doesn't mean it's safe to switch to reject today.
• Receivers decide how to apply your policy. Some apply local overrides, for example for mailing lists.
• DMARC protects the exact From domain. It doesn't stop look-alike domains such as examp1e.com.

Related

For the bigger picture, read SPF vs DKIM vs DMARC, or check every record at once with the Email Health Check.