---
title: Is our domain being spoofed? How to check a DMARC record with the DMARC Checker
description: Customers receive phishing that looks like it came from your domain, or Gmail asks bulk senders for DMARC. To check a DMARC record, look up the TXT record at _dmarc.yourdomain and read its policy: p=none only monitors, quarantine sends failing mail to spam, reject blocks it. Here's how to do it with the free DMARC Checker and what every tag means.
canonical: https://watchfor.io/blog/how-to-check-a-dmarc-record
---

# Is our domain being spoofed? How to check a DMARC record with the DMARC Checker

2026-10-04 · WatchFor Team · Guides · guides, email, security

Customers receive phishing that looks like it came from your domain, or Gmail asks bulk senders for DMARC. To check a DMARC record, look up the TXT record at _dmarc.yourdomain and read its policy: p=none only monitors, quarantine sends failing mail to spam, reject blocks it. Here's how to do it with the free DMARC Checker and what every tag means.

To check a DMARC record, look up the TXT record at `_dmarc.` plus your
domain (for example `_dmarc.example.com`) and read the `p=` tag. `p=none`
tells receivers to deliver mail that fails authentication anyway and only
report it; `p=quarantine` sends it to spam; `p=reject` refuses it. If spoofed
mail carrying your domain reaches inboxes, the policy is usually `none`, or
there is no record at all.

The free [DMARC Checker](/dmarc-record-checker) fetches the record from a
WatchFor location and lays out every tag. No signup.

## What this tool answers

*What do receivers do with mail that fakes our domain?* Reach for it when a
customer forwards a phishing email that used your From address, when a
provider's sender guidelines ask for DMARC (Gmail has required it from bulk
senders since February 2024, with `p=none` as the minimum), or before you
tighten the policy and want to see what is published today.

## A real example

### Checking a DMARC record when spoofed mail reaches customers

The usual trigger: a customer gets an invoice "from" your domain that you
never sent. SPF and DKIM can only flag such mail as failing; DMARC is the
record that tells the receiving server what to do about it. So the first
question is what your DMARC record says.

We ran the check against a large public domain whose policy is enforcing.
In the [DMARC Checker](/dmarc-record-checker) we typed `github.com` and
pressed **Check DMARC**:

![The DMARC Checker for github.com: PASS, with the record v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1, policy p=quarantine in amber, subdomain sp=reject, pct 100, alignment adkim=r aspf=r and reporting rua and ruf both present](/blog/how-to-check-a-dmarc-record-result.webp)

The lookup took 99 ms and found exactly one valid record:

```text
v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1
```

Reading it tag by tag:

- `p=quarantine`: mail that claims to be from `github.com` and fails DMARC
  goes to the spam folder.
- `sp=reject`: for subdomains (`something.github.com`) failing mail is
  refused outright, which is stricter than the main domain.
- `pct=100`: the policy applies to all failing mail, not a sample.
- `adkim=r aspf=r`: relaxed alignment, the default. A DKIM signature or
  SPF domain from any subdomain of `github.com` counts as aligned.
- `rua` and `ruf`: aggregate reports and failure reports both go to
  `dmarc@github.com`, so someone can see who sends mail under the name.

**The answer:** spoofed mail using this domain lands in spam (or is refused,
for subdomains) at every receiver that applies DMARC. If your own check
shows `p=none`, that's why fakes reach the inbox: the record exists, and it
asks receivers to deliver them anyway.

## How to read the results

| What you see | What it means |
| --- | --- |
| **PASS / FAIL** | PASS: exactly one DMARC record exists at `_dmarc.<domain>` and starts with `v=DMARC1`. FAIL: none, or more than one. It says nothing about whether your mail passes DMARC. |
| **Record** | The raw TXT value, copyable. |
| **Policy** | `p=reject` green, `quarantine` amber, `none` red. The colour reflects how much protection the policy gives. |
| **Subdomain** | `sp=`, the policy for subdomains. Only shown when set; without it subdomains get the `p=` policy. |
| **Pct** | Share of failing mail the policy applies to (default 100). `pct=10` with `quarantine` means one in ten failing messages goes to spam. |
| **Alignment** | `adkim` and `aspf`: `r` (relaxed, a subdomain match is enough) or `s` (strict, the exact domain). |
| **Reporting** | `rua✓` if aggregate reports are requested, `ruf✓` for failure reports. A cross means nobody receives that report type. |
| **Notes** | Appears for problems like "multiple DMARC records", which receivers treat as no DMARC at all. |

## More ways to use it

- **Rolling out enforcement.** Start with `p=none` and an `rua` address,
  read the reports for a few weeks, fix the senders that fail (often a
  CRM or helpdesk sending as your domain), then move to `quarantine` and
  later `reject`. The [DMARC setup guide](/blog/dmarc-setup-guide) walks
  through each stage.
- **After a DNS migration.** `_dmarc` is an easy record to lose when zones
  are copied by hand. Check it right after the move.
- **Checking a supplier before you trust their invoices.** A vendor with
  `p=reject` is much harder to impersonate than one with no record.
- **Parked domains.** A domain that never sends mail should publish
  `v=DMARC1; p=reject;` (plus an SPF record of `v=spf1 -all`) so nobody can
  use it in phishing.

## Tips and gotchas

- **The record lives at `_dmarc.`, not on the domain itself.** A
  `v=DMARC1` TXT record on `example.com` does nothing. Most DNS panels want
  the host field set to `_dmarc` only.
- **One record only.** Two `v=DMARC1` records (say, one from an old setup
  and one from a reporting service) mean receivers apply no DMARC at all.
  Merge them into one.
- **Subdomains inherit.** A subdomain without its own `_dmarc` record falls
  back to the main domain's record and its `sp=` policy. The checker only
  reads the exact name you type, so a FAIL on `docs.github.com` doesn't mean
  it's unprotected; check the parent too.
- **DMARC needs alignment, not just a pass.** Mail passes DMARC only when
  SPF or DKIM passes *for the domain in the From header*. A provider that
  signs with its own domain passes DKIM and still fails DMARC. The
  [email header guide](/blog/how-to-read-email-headers) shows how to spot
  that in a real message.
- **Going to `reject` too early bounces real mail.** Read the aggregate
  reports first. Every legitimate sender has to pass with alignment before
  enforcement.

## Check it from the command line too

```bash
dig +noall +answer @1.1.1.1 TXT _dmarc.github.com
```

```text
_dmarc.github.com.	300	IN	TXT	"v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1"
```

`fo=1` (which the checker doesn't list separately) asks for a failure report
whenever either SPF or DKIM doesn't produce an aligned pass, not only when
both fail. For contrast, a
valid record that blocks nothing:

```bash
dig +noall +answer @1.1.1.1 TXT _dmarc.gmail.com
```

```text
_dmarc.gmail.com.	600	IN	TXT	"v=DMARC1; p=none; sp=quarantine; rua=mailto:mailauth-reports@google.com"
```

And a subdomain without its own record, which inherits the parent's
`sp=reject`:

```bash
dig +noall +answer +comments @1.1.1.1 TXT _dmarc.docs.github.com | grep status
```

```text
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 50494
```

## Keep watching it

DMARC records disappear in DNS moves and get loosened during troubleshooting
and never tightened again. An [email monitor](/email-monitoring) (the email
policy type) re-checks the record on a schedule: **DMARC Record Missing**
fires by default when it's gone, and the optional **Weak DMARC Policy** rule
fires while it stays at `p=none`. The same monitor watches SPF and, with
your selectors, DKIM.

## FAQ

**How do I check if my domain has DMARC?**
Look up the TXT record at `_dmarc.yourdomain.com`, with a DMARC checker or
`dig TXT _dmarc.yourdomain.com`. No answer (`NXDOMAIN`) means no DMARC; an
answer starting with `v=DMARC1` is your policy.

**What is the difference between p=none, quarantine and reject?**
`none` only collects reports and delivers failing mail normally.
`quarantine` asks receivers to put failing mail in spam. `reject` asks them
to refuse it during delivery, so it never reaches the mailbox.

**Is p=none enough?**
It meets the minimum Gmail asks of bulk senders, and it's the right first
step because the reports show who sends as your domain. It doesn't stop
spoofing. Plan the move to `quarantine` once the reports are clean. How the
three records work together is in
[SPF, DKIM and DMARC explained](/blog/spf-dkim-dmarc-explained).

---

Canonical page: https://watchfor.io/blog/how-to-check-a-dmarc-record · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt