DMARC Checker

Check your domain's DMARC record in seconds. See if it exists, whether the policy actually protects you, and exactly what to publish if it does not.

We query your live DNS. Nothing to install, no signup to see your result.

What this checker looks at

Enter your domain and we query your live DNS records. The checker verifies:

Each item returns pass, warn, or fail, with the exact DNS record to publish when something is missing.

What a DMARC record looks like

A DMARC record is a TXT record published at _dmarc.yourdomain.com. A typical record:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

Tag reference:

TagMeaningNotes
vVersion. Must be DMARC1Required, must come first
pPolicy: none, quarantine, or rejectRequired. none = monitor only
ruaWhere aggregate reports are emailedUse a mailbox you actually read
rufFailure reportsMany providers no longer send these
spPolicy for subdomainsDefaults to the value of p
pctPercent of failing mail policy applies toDefault 100. Used to ramp up safely
adkimDKIM alignment: r (relaxed) or s (strict)Default r
aspfSPF alignment: r (relaxed) or s (strict)Default r

One detail that trips people: if rua points to a mailbox on a different domain, that domain must publish an authorization record, or receivers ignore the address.

How to read your result

Policy is the headline. p=reject and p=quarantine mean receivers are told to act on mail that fails authentication. p=none means you are only watching. Missing means anyone can send as your domain with nothing telling receivers to stop it.

Reporting is your eyes. Without a rua address you cannot see which services send mail as your domain, so you can never tighten the policy safely.

Alignment is the silent breaker. DMARC passes only when SPF or DKIM passes AND that domain aligns with your visible From domain. This is the part that most often breaks after switching email providers, adding a CRM, or turning on a new sending tool.

The safe path from p=none to p=reject

  1. Publish v=DMARC1; p=none with a rua address. Nothing changes for your mail. You start receiving reports.
  2. Read the reports for two to four weeks. List every service that legitimately sends as your domain.
  3. Fix alignment for each one: correct SPF includes, correct DKIM signing with your domain.
  4. Move to p=quarantine. Use pct to ramp gradually if your volume is large.
  5. When reports show no legitimate mail failing, move to p=reject.

Jumping straight to p=reject without steps 2 and 3 is how businesses lose real invoices and support replies. The order matters more than the speed.

Common DMARC failures and fixes

No DMARC record. Publish a TXT record at _dmarc.yourdomain.com starting with p=none plus a rua address. Monitor, then tighten.

Policy stuck at p=none. Monitoring forever is not protection. Spoofed mail still reaches your customers. Follow the migration path above.

No rua address. You are blind. Add rua=mailto: with a monitored mailbox.

Multiple DMARC records. Receivers treat the whole thing as invalid. Keep exactly one.

Syntax errors. A missing v tag, a typo like p=non, or a bad separator invalidates the record. This checker flags the exact character-level problem.

Alignment failures. SPF passing on a bounce domain that is not yours, or DKIM signed by your email provider's domain instead of yours, both fail alignment. Forwarded mail routinely breaks SPF, which is why aligned DKIM matters: it survives forwarding.

What this checker does not do

This tool checks your DNS configuration. It does not measure where your emails land. No DNS-based tool can honestly tell you your inbox placement, because placement depends on how your domain behaves over time, not just its records. If a tool promises an inbox rate from a DNS lookup, be skeptical.

A correct DMARC record is the entry ticket. Sender reputation is the rest of the game.

It also does not read your DMARC aggregate reports. Once rua= is publishing and receivers start sending you XML, open the report analyzer: Now read the DMARC reports receivers send you.

DMARC is one of eight checks

The full Humerly email setup audit checks MX, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, BIMI, and blacklist status, then hands you a single Email Setup Score with a numbered fix plan.

Run the full setup audit

Frequently asked questions

What is a DMARC record?

A TXT record in your DNS that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment, and where to send reports about them.

Is p=none enough?

No. p=none only monitors. It does not stop spoofed mail. It is the correct starting point, not the destination.

What is the difference between p=none, p=quarantine, and p=reject?

none asks receivers to do nothing and just report. quarantine asks them to treat failing mail as suspicious, which usually means the spam folder. reject asks them to refuse it outright.

Does DMARC work without SPF and DKIM?

No. DMARC sits on top of them. It needs at least one of SPF or DKIM to pass and align with your From domain.

How long does a DMARC change take to apply?

DNS changes typically propagate within minutes to a few hours, depending on your record's TTL.

Will moving to p=reject break my email?

It can, if legitimate senders are not aligned. That is why you monitor reports on p=none first, fix alignment, then tighten.

Does DMARC guarantee inbox delivery?

No. It authenticates your mail. Inbox providers also judge your sending behavior, volume patterns, and recipient engagement.

Part of the Humerly email setup audit. We check your setup honestly and tell you exactly what to fix.