Check your domain's DMARC record in seconds. See if it exists, whether the policy actually protects you, and exactly what to publish if it does not.
Enter your domain and we query your live DNS records. The checker verifies:
Each item returns pass, warn, or fail, with the exact DNS record to publish when something is missing.
A DMARC record is a TXT record published at _dmarc.yourdomain.com. A typical record:
v=DMARC1; p=quarantine; rua=mailto:[email protected]
Tag reference:
| Tag | Meaning | Notes |
|---|---|---|
| v | Version. Must be DMARC1 | Required, must come first |
| p | Policy: none, quarantine, or reject | Required. none = monitor only |
| rua | Where aggregate reports are emailed | Use a mailbox you actually read |
| ruf | Failure reports | Many providers no longer send these |
| sp | Policy for subdomains | Defaults to the value of p |
| pct | Percent of failing mail policy applies to | Default 100. Used to ramp up safely |
| adkim | DKIM alignment: r (relaxed) or s (strict) | Default r |
| aspf | SPF alignment: r (relaxed) or s (strict) | Default r |
One detail that trips people: if rua points to a mailbox on a different domain, that domain must publish an authorization record, or receivers ignore the address.
Policy is the headline. p=reject and p=quarantine mean receivers are told to act on mail that fails authentication. p=none means you are only watching. Missing means anyone can send as your domain with nothing telling receivers to stop it.
Reporting is your eyes. Without a rua address you cannot see which services send mail as your domain, so you can never tighten the policy safely.
Alignment is the silent breaker. DMARC passes only when SPF or DKIM passes AND that domain aligns with your visible From domain. This is the part that most often breaks after switching email providers, adding a CRM, or turning on a new sending tool.
Jumping straight to p=reject without steps 2 and 3 is how businesses lose real invoices and support replies. The order matters more than the speed.
No DMARC record. Publish a TXT record at _dmarc.yourdomain.com starting with p=none plus a rua address. Monitor, then tighten.
Policy stuck at p=none. Monitoring forever is not protection. Spoofed mail still reaches your customers. Follow the migration path above.
No rua address. You are blind. Add rua=mailto: with a monitored mailbox.
Multiple DMARC records. Receivers treat the whole thing as invalid. Keep exactly one.
Syntax errors. A missing v tag, a typo like p=non, or a bad separator invalidates the record. This checker flags the exact character-level problem.
Alignment failures. SPF passing on a bounce domain that is not yours, or DKIM signed by your email provider's domain instead of yours, both fail alignment. Forwarded mail routinely breaks SPF, which is why aligned DKIM matters: it survives forwarding.
This tool checks your DNS configuration. It does not measure where your emails land. No DNS-based tool can honestly tell you your inbox placement, because placement depends on how your domain behaves over time, not just its records. If a tool promises an inbox rate from a DNS lookup, be skeptical.
A correct DMARC record is the entry ticket. Sender reputation is the rest of the game.
It also does not read your DMARC aggregate reports. Once rua= is publishing and receivers start sending you XML, open the report analyzer: Now read the DMARC reports receivers send you.
The full Humerly email setup audit checks MX, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, BIMI, and blacklist status, then hands you a single Email Setup Score with a numbered fix plan.
Run the full setup auditWhat is a DMARC record?
A TXT record in your DNS that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment, and where to send reports about them.
Is p=none enough?
No. p=none only monitors. It does not stop spoofed mail. It is the correct starting point, not the destination.
What is the difference between p=none, p=quarantine, and p=reject?
none asks receivers to do nothing and just report. quarantine asks them to treat failing mail as suspicious, which usually means the spam folder. reject asks them to refuse it outright.
Does DMARC work without SPF and DKIM?
No. DMARC sits on top of them. It needs at least one of SPF or DKIM to pass and align with your From domain.
How long does a DMARC change take to apply?
DNS changes typically propagate within minutes to a few hours, depending on your record's TTL.
Will moving to p=reject break my email?
It can, if legitimate senders are not aligned. That is why you monitor reports on p=none first, fix alignment, then tighten.
Does DMARC guarantee inbox delivery?
No. It authenticates your mail. Inbox providers also judge your sending behavior, volume patterns, and recipient engagement.