Check your DMARC record
Use this tool to run a quick check and see if a domain has a valid DMARC record, what it currently asks mail receivers to do, and what’s missing.
Frequently asked questions
How do I check my DMARC record?
In the field above, enter any domain, like dmarced.eu, and submit to run the check. We will then go ahead and query the needed DNS records, interpret them, and provide you with our findings right below the field shortly after.
The DMARC check is selected by default. You may run the SPF and DKIM checks at the same time by selecting them.
What will I see in my DMARC check result?
After running our DMARC check, you'll be present with the following information:
- Effect – A summary on how participating inbox providers behave, following your current DMARC configuration.
- Findings – Everything we have to say about your current DMARC record. What’s off, how inbox providers may behave encountering it, and why that matters.
- Observations – The DMARC TXT record we received directly from the authoritative DNS server, including details like it's DNSSEC state.
What does a good DMARC record look like?
If you're just starting out with DMARC, this is the kind of record you want:
v=DMARC1; p=none; rua=mailto:dmarc@example.comThree parts:
- The
v=DMARC1prefix marks the TXT record as a DMARC record and lets inbox providers know that you are participating in the DMARC standard. p=nonetells inbox providers what to do with mail that fails DKIM and SPF verification. Here, we accept such mail, which is the recommended starting point when adopting DMARC. After validating the DMARC, DKIM, and SPF set up through DMARC reports (see below), it is recommended to enforce DMARC usingp=quarantineorp=reject.ruaenables monitoring and sets the destination where you want to receive daily aggregate reports from inbox providers. These reports include how many emails inbox providers received from your domain, if these emails could be verified through DKIM and SPF, and if not, why. In the above example the reports would be sent to ndmarc@example.com.
What should my DMARC policy be?
There are three DMARC policies to choose from: p=none, p=quarantine, and p=reject. It is recommended that you end up with p=reject, however, it's not where you start. Jumping straight to p=reject without validating your DMARC configuration using real data from DMARC reports may result in legitimate mail (e.g. a quote, an invoice, a newsletter) being blocked.
If you are just getting started, it is recommended to signal DMARC participation by creating a DMARC record in the first place, setting its policy to p=none to disable enforcement for now, and set its RUA destination to a mail address of your choice to start monitoring results.
Example:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Afterwards, you will start receiving DMARC reports showing you every source sending as your domain, including the ones you forgot about: the newsletter tool, some obscure but important web server, the invoicing system. Fix what's failing and once you feel confident about your configuration, start moving to p=quarantine, then p=reject.
Do I need SPF and DKIM, too?
Yes. DMARC does not introduce new verification methods on its own but bases enforcement decisions on DKIM and SPF results. It is recommended to set up DKIM first, then add SPF as a fall back.
Learn more:
- Check your DKIM record with our free DKIM check or learn how DKIM seals your mail
- Check your SPF record with our free SPF check or read about what SPF actually does
Why doesn't my new DMARC record show up?
We walk the DNS tree down to the name servers responsible for your domain and ask them directly, so what you see is what they're publishing right now.
That means a missing record is almost always on your provider's side – some take a moment to process a change, or to push it across their own name servers. Wait a minute and run the check again.
If it's still missing, it's usually one of these:
- the record belongs at
_dmarc.example.com, not atexample.com. Most DNS providers add your domain for you, so you only type_dmarcin the name or host field. Typing the whole address and you could end up with_dmarc.example.com.example.com, or - some providers keep changes in a draft state until you publish or apply them. Open the record again and make sure it's really live.
Read more about DNS on this page.
What tags are DMARC records made of?
In our findings we may list issues with the following DMARC tags:
| Tag | Description |
|---|---|
v | Version – This tag is required, and the only valid value today is DMARC1. If the record doesn’t start with v=DMARC1, inboxes will ignore the DMARC policy. |
p | Policy – what inbox providers should do with unverified mail. This tag is required. Without it, they can’t apply DMARC. Use none, quarantine, or reject. |
sp | Subdomain policy – what inbox providers should do with failing mail from your subdomains. |
t | Testing – tells inbox providers you’re still testing, so they handle failing mail one level below your actual policy. Should be used instead of the pct tag. |
rua | Reporting URI for aggregate data – where mail servers should report their daily DMARC reports to. |
ruf | Reporting URI for forensic data – where inbox providers should be sending notifications to when an email that fails authentication is being received. |
aspf | SPF alignment – how tightly the Envelope From domain must match Header From. Use r (relaxed) or s (strict). By default will be set to relaxed alignment. |
adkim | DKIM alignment – defines how tight the DKIM alignment is set, similiar to aspf. Use r (relaxed) or s (strict). By default will be set to relaxed alignment. |
Not every tag is here – see all DMARC tags and what they do.
Start monitoring your email traffic today!
Ready to gain full visibility into your email traffic? Sign up to start monitoring your emails and take control of your domain’s security today.