---
title: Free DMARC Checker
description: Read a domain's DMARC record — policy, subdomain policy, pct, alignment modes and whether aggregate and failure reports are requested.
canonical: https://watchfor.io/dmarc-record-checker
---

[Back to all free tools](/free-tools)

# DMARC Checker

Read a domain's DMARC record — policy, subdomain policy, pct, alignment modes and whether aggregate and failure reports are requested.

[How to use this tool](/blog/how-to-check-a-dmarc-record)

Result

No result yet

Fill in the form above and run it — the result appears here.

Monitor this 24/7 — get alerted when a failure is confirmed.

[Start free](/auth/sign-up)

Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms).

## What is DMARC Checker ?

DMARC (Domain-based Message Authentication, Reporting, and Conformance — RFC 7489) is the policy layer that sits on top of SPF and DKIM. It tells receivers what to do when those checks fail and where to send reports about your domain's mail traffic. Without DMARC, SPF and DKIM are signals receivers can choose to act on; with DMARC at enforcement, they're rules receivers must follow.

This tool fetches _dmarc.<domain> from DNS and shows the record with the values that decide what receivers do: the policy (monitor-only, quarantine or reject), the subdomain policy, pct , the SPF and DKIM alignment modes, and whether aggregate ( rua ) and failure ( ruf ) reports are requested. It flags a missing record and a second v=DMARC1 record, which receivers treat as no DMARC at all.

## How it works

DMARC is one DNS record at a specific name:

- 1 Query _dmarc.<domain> — DMARC lives at the _dmarc subdomain as a TXT record. So for example.com , query TXT _dmarc.example.com . The record starts with v=DMARC1 .
- 2 Parse tags — Tags are semicolon-separated key=value pairs. Required: v=DMARC1 , p=<policy> . Common: rua=mailto:reports@example.com (aggregate reports), pct=100 (percentage of mail to apply policy to), sp=<subdomain policy> , adkim=<DKIM alignment> , aspf=<SPF alignment> , fo=<failure report options> , ri=<report interval> .
- 3 Read the policy strength — The policy is coloured by strength: p=none (monitor only), p=quarantine (spam folder), p=reject (bounce). pct<100 means partial enforcement. Receivers are strict about syntax — a record with a typo in a tag can be ignored — so read the record line too; this tool doesn't lint every tag.
- 4 Report aggregate / forensic destinations — rua=mailto: is the aggregate report destination (daily XML summaries). ruf=mailto: is forensic reports (individual failure samples — less commonly enabled because of privacy). Verify these addresses exist and your team monitors them.

## When you'd use it

### DMARC rollout — moving toward p=reject

Standard path: deploy at p=none with rua= set. Monitor aggregate reports for 2-4 weeks to identify legitimate senders failing alignment. Fix them (add to SPF, get them DKIM-signing, or add an aligned domain). Move to p=quarantine for 2 weeks. Move to p=reject . Run DMARC checks at each stage to confirm published policy matches intent.

### Domain spoofing defense

Phishing campaign using your domain. Check DMARC — if p=none , your domain is not actively defended. Move to p=quarantine immediately as a stopgap; work toward p=reject after aggregate report review.

### Pre-launch deliverability check

Before sending mail at scale from a new domain, configure DMARC and verify with this tool. p=none at launch is fine; what matters is that the record exists and points to a real rua= mailbox for monitoring.

### Subdomain policy verification

DMARC's sp= tag controls subdomain handling. Unset = subdomains inherit parent policy. Explicit sp=reject is good for domains that have parked subdomains that should never send mail (defends against subdomain spoofing).

### Aggregate report receiver setup

Confirm rua= points to an address you actually monitor. Receivers send daily XML reports. Parse with a tool like dmarcian, Postmark, or opendmarc . Without active monitoring, DMARC is half-deployed.

## Reading the result

### Policy ( p= )

none = monitor only, no enforcement. quarantine = receivers should treat failing mail as suspicious (usually spam folder). reject = receivers should bounce failing mail at SMTP time. Production-ready: quarantine or reject .

### Subdomain policy ( sp= )

Policy for subdomains. If unset, subdomains inherit the parent's p= . Explicit sp= overrides for subdomains only. Common pattern: p=reject; sp=reject for full coverage, or p=quarantine; sp=reject to lock down subdomains harder than the parent.

### Percentage ( pct= )

Percentage of mail to apply the policy to. Used during gradual rollout — p=quarantine; pct=25 means 25% of failing mail is quarantined, the other 75% is just monitored. Helpful for de-risking when you're not sure what will break.

### Alignment mode ( adkim , aspf )

r (relaxed, default) allows subdomain alignment — DKIM signed by mail.example.com aligns with From: example.com . s (strict) requires exact match. Most setups use relaxed; strict is for security-critical domains where you want to prevent any subdomain mail from inheriting parent's reputation.

### Reporting ( rua= , ruf= )

rua= = aggregate reports — daily XML summaries of pass/fail counts, source IPs, alignment status. Should always be set. ruf= = forensic reports — per-message failure details with headers. Less common due to privacy concerns (the full message gets sent to you).

## Common pitfalls

### DMARC at p=none forever

Audit mode. Receivers report what they would have done but don't act. Many teams set it and forget; that means spoofers can still impersonate your domain because receivers aren't enforcing. Use aggregate reports to identify legitimate senders, fix them, then move to p=quarantine and eventually p=reject .

### rua= set to an address no one monitors

Daily XML reports arrive forever, no one reads them. Defeats the audit purpose of DMARC. Use a service (dmarcian, Postmark DMARC, native ESP DMARC views) that parses reports into something humans actually read.

### Moving to p=reject without monitoring

If a legitimate sender wasn't covered by your SPF/DKIM, their mail will start bouncing at receivers as soon as p=reject lands. Always: monitor at p=none for weeks, fix all gaps, then move up. Skipping monitoring is how you ship the email outage that takes down customer-facing notifications.

### Subdomain DMARC missing

Without sp= , subdomain policy = parent policy. But subdomains often need DIFFERENT policy — e.g. you send marketing from marketing.example.com and want it at p=quarantine while parent is at p=reject . Explicit sp= lets you control.

## Run DMARC Checker on every change, not just once.

Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card.

[Start free](/auth/sign-up)

## Frequently asked questions

What's the difference between p=quarantine and p=reject ? quarantine sends failing mail to the spam folder (still delivered, just demoted). reject bounces failing mail outright at SMTP — sender gets a 5xx response, recipient never sees it. reject is stricter and the recommended end state once your sender hygiene is confirmed.

How long should I wait at p=none before moving to enforcement? 2-4 weeks of aggregate report review at minimum. Long enough to capture your full sending cycle (weekly newsletters, monthly invoices, etc.) and identify every legitimate sender. Move to p=quarantine with pct=10 first, ramp up over weeks.

What does DMARC alignment mean? DMARC requires that SPF or DKIM not just pass, but also align with the From: header. SPF alignment: the SPF-validated domain (envelope MAIL FROM ) matches the From: header domain. DKIM alignment: the DKIM signing domain ( d= tag) matches From:. Without alignment, SPF/DKIM passes but DMARC fails.

Why is my legitimate mail failing DMARC even though SPF passes? Alignment. SPF might pass for the envelope sender ( bounce@mail.sendgrid.net ) while the From: header shows you@example.com . They don't align. Solution: get the ESP to use a custom return-path that matches your domain ( bounce@example.com ), or rely on DKIM (signed by example.com ) for alignment.

Where do DMARC aggregate reports come from? From every receiver that processed mail claiming to be from your domain. Gmail, Microsoft, Yahoo, Apple — all send daily XML to whatever rua= you specify. Volume scales with your mail volume; high-volume senders see millions of records aggregated into the reports.

Can I have DMARC without SPF or DKIM? Technically yes, but pointless. DMARC enforces against SPF AND DKIM alignment results — if neither is set up, every message fails DMARC alignment regardless of policy. Set up at least one (ideally both) before deploying DMARC at enforcement.

What's the BIMI tag and does this tool check it? BIMI (Brand Indicators for Message Identification) shows your logo next to authenticated mail in supporting clients (Gmail, Yahoo). Requires DMARC at p=quarantine or p=reject . BIMI lives at a separate DNS record ( default._bimi.<domain> ) — not part of DMARC. We don't check BIMI in this tool.

Can DMARC break legitimate forwarding? Yes — forwarders that don't preserve DKIM signatures (mailing lists that add subject prefixes, ARC-unaware forwarders) will trigger DMARC failures. ARC (Authenticated Received Chain) is the workaround — modern mailing lists and forwarders should implement ARC to preserve the authentication chain.

## Related email tools

- [Email HealthCheck a domain's SPF and DMARC records in one run, with a letter grade. DKIM needs a selector, so it shows as not checked here; use the DKIM Checker for the key.](/email-policy-checker)
- [SPF CheckerRead a domain's SPF record — its all policy, includes, a second-record check and a count of the DNS lookups the record itself makes (includes are counted, not followed).](/spf-record-checker)
- [DKIM CheckerCheck the DKIM key published for a selector — the record, key type and key size, and whether the key is live or revoked.](/dkim-record-checker)
- [SMTP Server TestConnect to any mail server on port 25, 465 or 587 from a real probe location and see what a sending server sees — the banner, whether STARTTLS is offered, whether reverse DNS matches, and whether it relays for strangers. Verify a new mail host before you route production mail through it.](/smtp-test)

---

Canonical page: https://watchfor.io/dmarc-record-checker · Site guide: https://watchfor.io/llms.txt