# DMARC Checker

URL: https://iblockspam.com/tools/dmarc-checker
Last updated: 2026-10-09

> Find out whether your domain publishes a valid DMARC policy, how strict it is, and whether you'll receive reports about who sends mail as you.

Free tool: Check your policy, reporting and the safe path from p=none to reject. Use it at https://iblockspam.com/tools/dmarc-checker

## What the DMARC Checker looks at

DMARC lets you publish a policy at `_dmarc.yourdomain` telling receivers how to treat mail that claims to be from you but fails authentication. The current specification is [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html) (May 2026), which obsoletes [RFC 7489](https://www.rfc-editor.org/rfc/rfc7489.html). Aggregate reports are now defined in RFC 9990 and failure reports in RFC 9991.

The checker:

- Finds the DMARC record at `_dmarc.yourdomain`. For a subdomain with no record of its own, it falls back to the parent domain's record.
- Fails a missing record, more than one record, or a missing or invalid `p` value, and checks that `adkim` and `aspf` are `r` or `s`.
- Grades the policy: `reject` and `quarantine` pass; `p=none` is a warning.
- Warns when testing mode (`t=y`) is on, when `sp=none` leaves subdomains open under a stricter `p`, and when `pct` is below 100 (RFC 9989 removed `pct`).
- Checks that a `rua` address is set and that report addresses on another domain are authorized ([RFC 9990 §4](https://www.rfc-editor.org/rfc/rfc9990.html#section-4)).

## How to read the results

- **Pass.** A valid record at `p=quarantine` or `p=reject`, with a working `rua` address.
- **Warning.** Valid, but not protecting you fully. Examples: `p=none`, `t=y` (test mode, which tells receivers to apply one level below your published policy), no `rua`, or `sp=none` under a stricter `p`.
- **Fail.** Missing, invalid or ignored. Examples: no record, more than one record, a record that doesn't start with `v=DMARC1`, or an invalid `p` value.
- **Not tested.** DNS didn't answer. Try again.
- **Not applicable.** We don't use this for DMARC. Every domain, including one that sends no mail, should publish a DMARC record.

### What alignment means

DMARC passes when **either** of these is true:

- SPF passes, and the envelope sender domain aligns with the From domain.
- DKIM passes, and the signing domain (`d=`) aligns with the From domain.

"Relaxed" alignment (the default) accepts the same organizational domain, so `news.example.com` aligns with `example.com`. "Strict" (`adkim=s`, `aspf=s`) requires an exact match.

## Common problems and fixes

**No DMARC record.** Start by monitoring:

```
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
```

**Stuck at p=none.** Once your reports show all legitimate senders passing, move up:

```
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
```

Do this one step at a time, and publish only one of these at once. Our [staged DMARC rollout guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) has a timeline.

**Two DMARC records.** Receivers ignore DMARC entirely if they find more than one. Delete the extra.

**Reports sent to another domain without authorization.** If `example.com` sends reports to `reports@example.net`, then `example.net` must publish:

```
example.com._report._dmarc.example.net.  TXT  "v=DMARC1"
```

**Domain that sends no mail.** Use the strictest policy:

```
_dmarc.example.com.  TXT  "v=DMARC1; p=reject;"
```

**Still using pct.** Under RFC 9989, `pct` is gone. To soften a new `quarantine` or `reject` policy while you test, use `t=y` instead. Some receivers still follow RFC 7489, so the change in behavior may be gradual.

## What the mailbox providers expect

[Google](https://support.google.com/mail/answer/81126) (close to 5,000 messages a day) and [Yahoo](https://senders.yahooinc.com/best-practices/) (bulk senders, no published threshold) require bulk senders to publish DMARC (at least `p=none`) and to pass it with aligned SPF or DKIM. Yahoo strongly recommends a `rua` address. Since November 2025, Google's [sender guidelines FAQ](https://support.google.com/mail/answer/14229414) has said it is ramping up enforcement, with temporary and permanent rejections for mail that doesn't meet the requirements.

## Subdomains and parked domains

A DMARC record on `example.com` also covers its subdomains unless a subdomain publishes its own. Use `sp` to set a different policy for existing subdomains, and `np` for subdomains that don't exist, which attackers sometimes invent (`billing.example.com`). If you own parked domains that never send mail, give each one its own `p=reject` record; they're easy targets because nobody watches them.

## Limitations

- The checker reads your published policy. It can't tell you which of your senders pass or fail; only DMARC aggregate reports show that.
- A strict policy is only safe once all legitimate mail passes. A Pass here doesn't mean it's safe to switch to `reject` today.
- Receivers decide how to apply your policy. Some apply local overrides, for example for mailing lists.
- DMARC protects the exact From domain. It doesn't stop look-alike domains such as `examp1e.com`.

## Related

For the bigger picture, read [SPF vs DKIM vs DMARC](https://iblockspam.com/blog/spf-vs-dkim-vs-dmarc), or check every record at once with the [Email Health Check](https://iblockspam.com/tools/email-health-check).

## Frequently asked questions

### What does DMARC do?

DMARC links SPF and DKIM to the From address people see. A message passes DMARC if SPF or DKIM passes for a domain that aligns with the From domain. Your policy tells receivers what to do with mail that fails.

### Is p=none a failure?

No, but it's a Warning. p=none collects reports without asking receivers to act on failures, so it doesn't stop spoofing. It's the right first step and the minimum Gmail and Yahoo expect from bulk senders.

### What happened to the pct tag?

RFC 9989, published in May 2026, replaces RFC 7489 and removes pct. It adds a t (test mode) tag instead. Receivers that still follow RFC 7489 may honor pct, so we report it but don't rely on it.

### Where should DMARC reports go?

Set rua to a mailbox or reporting service you actually read. If the address is on a different domain, that domain must publish a record authorizing it to receive your reports.

### Does iBlockSpam read my DMARC reports?

This free checker only validates your record; it doesn't collect reports. Customers can turn on DMARC monitoring, included with every plan: add rua=mailto:dmarc@iblockspam.com and the portal shows who sends as your domain and what fails.

---

Source: iBlockSpam, https://iblockspam.com/tools/dmarc-checker (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt