DMARC Record Checker

What is a DMARC checker?

A DMARC checker looks up a domain’s DMARC record and explains what it tells receiving mail servers to do. DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc.yourdomain.com. It ties SPF and DKIM to the address people actually see in the From line, tells receivers what to do with mail that fails (nothing, spam folder or reject) and asks them to send you reports about who is sending email using your domain.

This free DMARC checker reads your record, grades it from A to F, translates every tag into plain English, warns about the mistakes that quietly disable DMARC, and gives you a ready-to-publish starter record if you do not have one yet. It also checks the organisational domain when you look up a subdomain, because subdomains inherit the parent’s policy.

How to use the DMARC checker

1. Enter your domain, for example yourcompany.com.
2. Press “Check DMARC”. The tool looks up _dmarc.yourcompany.com and, if needed, the parent domain.
3. Read the grade. A means p=reject with reporting on. B is quarantine. C and D are monitoring only. F means no record.
4. Follow the fixes under each amber or red check, then run the checker again.

Why DMARC matters more than ever

Since February 2024, Google and Yahoo have required anyone who sends more than about 5,000 messages a day to their users to publish a DMARC record (at least p=none), authenticate with SPF and DKIM, and keep spam complaint rates low. Microsoft announced matching requirements for Outlook.com, Hotmail and Live.com senders in 2025. Below those volumes DMARC is not strictly required, but its absence is a negative signal, and cold email senders are exactly the kind of sender filters look at closely.

DMARC also protects your brand. Without an enforced policy, anyone can send email that appears to come from your domain, whether invoice fraud, phishing or spam, and some of the damage lands on your domain’s reputation.

How DMARC works

For a message to pass DMARC, at least one of these must be true:

• SPF passes and aligns: the envelope sender domain used for SPF matches the visible From domain (exactly, in strict mode, or sharing the same organisational domain, in relaxed mode).
• DKIM passes and aligns: the d= domain in a valid DKIM signature matches the visible From domain in the same way.

If neither is true, the receiver applies your policy. Because DKIM survives forwarding and SPF does not, DKIM alignment is the one that carries DMARC for most legitimate mail.

DMARC tags explained

p=none vs quarantine vs reject

p=none: monitoring

Nothing happens to failing mail. You get reports showing every source that sends using your domain. This is the right first step and satisfies the Google and Yahoo minimum, but it gives no protection against spoofing. Most domains that publish DMARC never move beyond it, which is a missed opportunity.

p=quarantine: spam folder

Failing mail goes to spam. Strong protection, with a safety net: if you have missed a legitimate sender, its mail lands in spam rather than disappearing.

p=reject: refused

Failing mail is refused outright. Full protection, and a requirement for showing your logo through BIMI in most inboxes. Move here once reports have been clean for a few weeks.

A safe path to full enforcement

1. Publish v=DMARC1; p=none; rua=mailto:[email protected]; fo=1.
2. Read reports for two to four weeks. They are XML files; a free DMARC report analyser makes them readable. List every service that sends as you.
3. Fix authentication for each legitimate sender: add its include to SPF (check with the SPF Checker) and turn on DKIM signing with your domain (check with the DKIM Checker).
4. Move to p=quarantine; pct=25, then raise pct to 100 over a couple of weeks.
5. Move to p=reject once quarantine has been quiet.

Mistakes that silently break DMARC

Two DMARC records

If _dmarc has two TXT records starting with v=DMARC1, receivers ignore DMARC entirely. Delete all but one.

Record at the wrong host

The record must be at _dmarc.yourdomain.com, not at the root. In most DNS editors you type _dmarc in the host field; typing the full name can create _dmarc.yourdomain.com.yourdomain.com.

Missing or invalid p= tag

Without a valid policy, the record is invalid. p must be none, quarantine or reject.

Reports going to another domain without authorisation

If rua points to an address at a different domain, that domain must publish a record authorising it, or receivers will not send reports. Report services set this up for you.

Strict alignment with tools that use subdomains

adkim=s or aspf=s requires an exact domain match. Many sending tools sign or bounce with a subdomain, which fails strict alignment. Relaxed is right for almost everyone.

How to publish a DMARC record, step by step

1. Make sure SPF and DKIM work first. DMARC depends on them. Check both with the SPF Checker and DKIM Checker.
2. Choose where reports go. A dedicated address such as [email protected], or the address a DMARC reporting service gives you. Reports arrive daily from each large receiver, so do not use a personal inbox.
3. Open your DNS host and add a TXT record. Host: _dmarc. Value: v=DMARC1; p=none; rua=mailto:[email protected]; fo=1.
4. Save and run this checker. You should see one record, policy none and reporting enabled.
5. Wait for reports, usually within a day or two, then follow the enforcement path above.

How to read DMARC aggregate reports

Aggregate (rua) reports are XML files, one per receiver per day. Each contains rows like this, in plain terms:

Group the rows by source. Sources you recognise that fail need fixing (usually DKIM not set up with your domain). Sources you do not recognise that fail are either spoofing, which enforcement will stop, or a forgotten service someone in your company uses. Reports never contain message content, only counts and results.

Gmail, Yahoo and Microsoft sender requirements at a glance

• All senders: SPF or DKIM, valid forward and reverse DNS for sending IPs, TLS for transmission, spam complaint rates kept low (Google publishes 0.3% as the threshold never to reach, and recommends staying under 0.1%).
• Bulk senders (roughly 5,000 or more messages a day to one provider): SPF and DKIM, DMARC with at least p=none, alignment of the From domain with SPF or DKIM, and one-click unsubscribe for marketing and subscribed messages.

One-to-one cold outreach usually sits below the bulk threshold per mailbox, but the same signals are measured, and a team with several mailboxes on one domain can cross it.

DMARC for domains that never send email

Parked domains, typo domains and old brand domains are favourite targets for spoofing because nobody watches them. Protect each one with three records: v=spf1 -all at the root, v=DMARC1; p=reject at _dmarc, and optionally a null MX. Together they tell every receiver that no legitimate mail ever comes from that domain.

DMARC and BIMI

BIMI (Brand Indicators for Message Identification) lets supporting inboxes show your logo beside your messages. It requires DMARC at enforcement: p=quarantine or p=reject with pct=100 (or no pct tag). Gmail and Apple Mail also require a Verified Mark Certificate or Common Mark Certificate. The Domain Health Checker shows whether a BIMI record is published.

DMARC record examples

Fixing DMARC failures from common services

When reports show a legitimate service failing DMARC, the fix is almost always to let that service sign with DKIM using your domain, usually called “custom domain authentication” or “domain verification” in its settings. Typical places to look:

• Google Workspace: Admin console, Apps, Google Workspace, Gmail, Authenticate email. Generate a 2048-bit key, publish it, then click Start authentication.
• Microsoft 365: Microsoft Defender portal, Email and collaboration policies, Email authentication settings, DKIM. Publish the two CNAME records, then enable signing.
• Marketing platforms (Mailchimp, HubSpot, Brevo and similar): a domain authentication page that gives you CNAME or TXT records for DKIM and, for some, a return-path subdomain for SPF alignment.
• Help desks and CRMs (Zendesk, Salesforce, Freshdesk and similar): an email or channel settings page with DKIM records for your domain.
• Website forms and servers: send through an authenticated mail service using your domain rather than the web server’s own mail function, which cannot pass DMARC.

Once each service signs with your domain, its rows in the reports turn to DKIM pass with alignment, and you can enforce safely.

Worked example

Acme publishes v=DMARC1; p=none; rua=mailto:[email protected]. The checker grades it C: monitoring only. Two weeks of reports show three sources: Google Workspace (SPF and DKIM pass, aligned), a marketing platform (SPF passes for the platform’s own domain, DKIM signed by the platform, so DMARC fails), and an unknown IP range in another country (everything fails). Acme completes domain authentication in the marketing platform so it signs with acme.com; a week later that source passes. The unknown source is spoofing. Acme moves to p=quarantine; pct=50, then p=quarantine, then p=reject. The checker now grades the record A, and the spoofed mail is refused by receivers.

Five DMARC myths

“DMARC will block my own email”

Only if you jump straight to p=reject before checking reports. Starting at p=none changes nothing for delivery; it only turns on reporting. Enforcement is a decision you make later, with data.

“p=none means I am protected”

It means you are watching. Spoofed mail still gets delivered. Protection starts at quarantine.

“DMARC fixes deliverability on its own”

DMARC removes a negative signal and is required for bulk senders, but placement still depends on reputation: who you send to, how many bounce, and how many people mark you as spam or reply. Authentication gets you considered; relevance gets you the inbox.

“Small senders do not need it”

The formal requirement applies to bulk senders, but a missing DMARC record is visible to every receiver and attackers target unprotected domains of every size. It takes five minutes to publish.

“Subdomains need separate records”

They inherit the parent’s policy automatically, or the sp tag. Publish a separate record only when a subdomain needs a different policy.

Glossary

• Alignment: the SPF or DKIM domain matching the visible From domain.
• Organisational domain: the registered domain, such as yourdomain.com for mail.yourdomain.com.
• Aggregate report (rua): a daily XML summary of results by sending source.
• Failure report (ruf): a sample of an individual failing message; rarely sent today.
• Enforcement: a policy of quarantine or reject.
• Spoofing: sending mail that falsely claims to come from your domain.

DMARC for cold email domains

Teams that use secondary domains for outreach should publish DMARC on every one of them, not just the main domain. A sensible setup is p=none with reporting during warm-up, then p=quarantine once you are confident every sending mailbox authenticates. Run each domain through the Domain Health Checker, which checks DMARC together with SPF, DKIM, MX and blocklists.

Remember that DMARC proves the mail is yours; it does not make people want it. Reputation still depends on sending to relevant people, keeping bounces low with the Email Verifier and writing messages people reply to.

How Prosyo helps

Prosyo sends from your own Google or Microsoft mailboxes, so mail is signed with your domain’s DKIM key and aligns with DMARC without extra setup. It keeps sending volumes inside safe limits, verifies addresses first and stops sequences on reply. Try it free for 7 days.

Related free tools

These tools are often used together with the DMARC Checker. All of them are free, and the checkers and calculators run instantly in your browser.

• Domain Health Checker: Score your sending domain on MX, SPF, DKIM, DMARC, BIMI, MTA-STS and blocklists in one click, with a fix for everything that fails.
• SPF Checker: Validate your SPF record, count its DNS lookups against the limit of 10 and see every include it depends on.
• DKIM Checker: Find your DKIM keys by selector or scan 40+ common selectors, with key length and revocation checks.
• Blacklist Checker: Check a domain and its mail servers against widely used DNS blocklists, with removal steps.