Check your domain's DMARC record in seconds. See if it exists, whether the policy actually protects you, and exactly what to publish if it does not.
Enter your domain and we query your live DNS records. The checker verifies:
Each item returns pass, warn, or fail, with the exact DNS record to publish when something is missing.
Measured 2026-09-24: 616 of 1,687 Y Combinator B2B companies with one readable DMARC record (36.5%) still carried pct, rf or ri, tags RFC 9989 removed. Method: How 1,939 Y Combinator B2B startups set up DMARC.
You do not need this page to see your record. Any of these prints the TXT record receivers read, straight from DNS:
dig +short TXT _dmarc.yourdomain.com
nslookup -type=txt _dmarc.yourdomain.com
Resolve-DnsName -Name _dmarc.yourdomain.com -Type TXT
dig comes with macOS and Linux. nslookup is on Windows, macOS and Linux. The third is PowerShell on Windows. An empty answer means no record is published. Two or more separate records mean receivers apply no policy at all, however strict each one looks (RFC 9989 §4.10: if multiple records are returned, they are all discarded).
This checker reads the same DNS answer and then adds what a raw record cannot show you: whether your report address is authorized to receive reports for this domain, whether subdomains inherit a weaker policy, and whether a test-mode tag is holding your published policy back.
A DMARC record is a TXT record published at _dmarc.yourdomain.com. A typical record:
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com
Tag reference:
| Tag | Meaning | Notes |
|---|---|---|
| v | Version. Must be DMARC1 | Required, must come first |
| p | Policy: none, quarantine, or reject | Required. none = monitor only |
| rua | Where aggregate reports are emailed | Use a mailbox you actually read |
| ruf | Failure reports | Optional. Defined in RFC 9989 §4.7; report format in RFC 9991 |
| sp | Policy for subdomains | Defaults to the value of p |
| np | Policy for non-existent subdomains | Applies only to subdomains that do not exist |
| t | Test mode: y or n | Default n. y asks receivers not to apply the policy yet |
| pct | Percent of failing mail policy applies to | Removed in RFC 9989. t=y stands in for pct=0; delete pct=100; values in between have no replacement. Details |
| rf | Failure report format | Removed in RFC 9989 (Appendix C.5.2) |
| ri | Aggregate report interval | Removed in RFC 9989 (Appendix C.5.2) |
| adkim | DKIM alignment: r (relaxed) or s (strict) | Default r |
| aspf | SPF alignment: r (relaxed) or s (strict) | Default r |
One detail that trips people: if rua points to a mailbox on a different domain, that domain must publish an authorization record, or receivers ignore the address.
Policy is the headline. p=reject and p=quarantine mean receivers are told to act on mail that fails authentication. p=none means you are only watching. Missing means anyone can send as your domain with nothing telling receivers to stop it.
Reporting is your eyes. Without a rua address you cannot see which services send mail as your domain, so you can never tighten the policy safely.
Alignment is the silent breaker. DMARC passes only when SPF or DKIM passes AND that domain aligns with your visible From domain. This is the part that most often breaks after switching email providers, adding a CRM, or turning on a new sending tool.
Jumping straight to p=reject without steps 2 and 3 is how businesses lose real invoices and support replies. The order matters more than the speed.
No DMARC record. Publish a TXT record at _dmarc.yourdomain.com starting with p=none plus a rua address. Monitor, then tighten.
Policy stuck at p=none. Monitoring forever is not protection. Spoofed mail still reaches your customers. Follow the migration path above.
No rua address. You are blind. Add rua=mailto: with a monitored mailbox.
Multiple DMARC records. Receivers treat the whole thing as invalid. Keep exactly one.
Syntax errors. A missing v tag, a typo like p=non, or a bad separator invalidates the record. This checker flags the exact character-level problem.
Alignment failures. SPF passing on a bounce domain that is not yours, or DKIM signed by your email provider's domain instead of yours, both fail alignment. Forwarded mail routinely breaks SPF, which is why aligned DKIM matters: it survives forwarding.
Each of these is a single question answered in full, for the cases this checker flags most often.
This tool checks your DNS configuration. It does not measure where your emails land. No DNS-based tool can honestly tell you your inbox placement, because placement depends on how your domain behaves over time, not just its records. If a tool promises an inbox rate from a DNS lookup, be skeptical.
A correct DMARC record is the entry ticket. Sender reputation is the rest of the game.
It also does not read your DMARC aggregate reports. Once rua= is publishing and receivers start sending you XML, open the report analyzer: Now read the DMARC reports receivers send you.
The full Humerly email setup audit checks MX, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, BIMI, and blacklist status, then hands you a single Email Setup Score with a numbered fix plan.
Run the full setup auditWhat is a DMARC record?
A TXT record in your DNS that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment, and where to send reports about them.
Is p=none enough?
No. p=none only monitors. It does not stop spoofed mail. It is the correct starting point, not the destination.
What is the difference between p=none, p=quarantine, and p=reject?
none asks receivers to do nothing and just report. quarantine asks them to treat failing mail as suspicious. reject asks them to refuse it.
Does DMARC work without SPF and DKIM?
No. DMARC sits on top of them. It needs at least one of SPF or DKIM to pass and align with your From domain.
How long does a DMARC change take to apply?
DNS changes typically propagate within minutes to a few hours, depending on your record's TTL.
Will moving to p=reject break my email?
It can, if legitimate senders are not aligned. That is why you monitor reports on p=none first, fix alignment, then tighten.
Does DMARC guarantee inbox delivery?
No. It authenticates your mail. It does not measure or decide where mail lands.
Reviewed by Venkat Nookala, last reviewed 2026-09-25.