DMARC Record Lookup Tool
Enter your domain to check your DMARC record configuration and find issues affecting your email authentication.
What Is a DMARC Record?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is an email authentication protocol built on top of SPF and DKIM. DMARC lets domain owners publish a policy in DNS telling receiving mail servers what to do with messages failing authentication.
A DMARC record is published as a TXT record in your DNS at _dmarc.yourdomain.com. The record contains tags defining your enforcement policy, where reports get sent, alignment requirements, and other settings. Without a DMARC record, receivers have no instructions from you and treat unauthenticated mail from your domain inconsistently.
When a receiving server gets an email claiming to be from your domain, it checks SPF and DKIM. DMARC then verifies alignment between the From header domain and the domains authenticated by SPF and DKIM. If both fail, the receiving server follows your policy: do nothing (none), send to spam (quarantine), or reject the message entirely (reject).
DMARC Tag Reference
Each DMARC record is made up of tags separated by semicolons. The table below explains every tag you will find in a DMARC record.
| Tag | Description |
|---|---|
| v | DMARC version. Always set to v=DMARC1. |
| p | Policy for the organizational domain. Accepts none, quarantine, or reject. |
| rua | Where aggregate reports are sent, as mailto: addresses separated by commas. Addresses on another domain need an authorization record on that domain. |
| ruf | Where failure (forensic) reports are sent, as mailto: addresses. Many receivers do not send these. |
| sp | Subdomain policy. Inherits the p tag value if omitted. |
| np | Policy for subdomains that do not exist in DNS. Defined in DMARCbis. Inherits sp if omitted. |
| adkim | DKIM alignment mode. Strict (s) requires an exact domain match. Relaxed (r) allows organizational domain match. Default is r. |
| aspf | SPF alignment mode. Strict (s) requires an exact domain match. Relaxed (r) allows organizational domain match. Default is r. |
| fo | Failure reporting options. 0 (default) asks for a report when both SPF and DKIM fail to align. 1 asks for a report when either one fails. d and s ask for reports on DKIM or SPF failures. |
| rf | Format for failure reports. Only afrf is defined. |
| pct | Percentage of failing messages the policy applies to. Default is 100. The rest get the next lower policy. DMARCbis drops this tag. |
| ri | Requested interval in seconds between aggregate reports. Default is 86400 (24 hours). Most receivers send daily. |
| t | DMARCbis testing flag. t=y asks receivers to apply one policy level lower than published. |
Why Check Your DMARC Record?
Prevent email spoofing
A missing or misconfigured DMARC record lets attackers spoof your domain. Checking your record confirms your policy is active and enforced.
Catch configuration errors
Typos, missing tags, and invalid values break your DMARC setup. A lookup tool surfaces these problems so you fix them before they affect mail delivery.
Avoid deliverability problems
Incorrect DMARC settings cause legitimate emails to land in spam or get rejected. Verifying your record protects your sender reputation and keeps your messages reaching the inbox.
Meet compliance requirements
Regulations and industry standards increasingly require DMARC enforcement. Checking your record helps you stay compliant with policies from governments, financial institutions, and email providers.
DMARC Best Practices
Start with p=none
Begin with a monitoring policy (p=none) to collect data about your email traffic. You learn which services send on your behalf before you enforce restrictions. Move to quarantine or reject only after you confirm all legitimate senders pass authentication.
Add reporting addresses
Include a rua tag so you receive aggregate reports. A ruf tag asks for failure reports, though many receivers do not send them. Without these, you have no visibility into which senders are passing or failing authentication. Reports are the foundation for moving toward enforcement.
Configure subdomain policies
Use the sp tag to set a policy for subdomains. Attackers often target subdomains because they are overlooked. Set sp=reject to block unauthorized mail from subdomains unless they have their own DMARC records.
Align both SPF and DKIM
DMARC passes when at least one authentication method aligns. Configuring both gives you a fallback if one fails. SPF breaks on forwarded mail, and DKIM breaks when relay servers modify the message. Having both active gives you consistent coverage.
Increment pct when moving to enforcement
Use the pct tag to apply your policy to a fraction of messages at first. Start with pct=10 and increase over time. This reduces the risk of blocking legitimate email while you verify your configuration.
Frequently Asked Questions
A DMARC record is a TXT record published in your DNS at _dmarc.yourdomain.com. It tells receiving mail servers how to handle messages from your domain after SPF and DKIM checks. You choose the enforcement level (none, quarantine, or reject) and specify where aggregate and forensic reports get sent.
A DMARC record lookup tool queries the DNS for the DMARC TXT record of any domain and displays the result in a readable format. It shows your policy, reporting addresses and alignment settings, and flags errors like missing records or syntax problems.
Checking your DMARC record confirms your policy is published correctly and your reporting addresses are valid. Misconfigured records leave your domain open to spoofing. Regular checks help you catch errors early and ensure receiving servers honor your enforcement policy.
DMARC reports show which senders are using your domain and whether their messages pass or fail authentication. You learn which services send email on your behalf and identify unauthorized senders. Reports give you the data you need to move from a monitoring policy to full enforcement without blocking legitimate mail.
A message is DMARC compliant when SPF or DKIM passes (or both) and the passing domain aligns with the From address. Alignment means the domain in the From address matches the domain verified by SPF or DKIM. Receiving servers use your DMARC policy to decide what to do with non-compliant messages.
DMARC uses SPF and DKIM to verify an email message. When a receiving server gets a message, it checks the SPF record and the DKIM signature. It then compares the results against the DMARC policy published by the sending domain. If the message fails both SPF and DKIM alignment, the receiving server follows the enforcement action you set (none, quarantine, or reject). The server also sends an aggregate report back to the address you specified in your DMARC record.
Domain alignment means the domain in the email From header matches the domain that passed SPF or DKIM verification. SPF alignment compares the envelope sender (Return-Path) domain. DKIM alignment compares the domain in the d tag of the DKIM signature. You set alignment to strict (exact match) or relaxed (organizational domain match) through the adkim and aspf tags.
The sp tag in your DMARC record sets the policy for subdomains when they do not have their own DMARC record. If a subdomain has its own DMARC record, that record takes priority. Without an sp tag, subdomains get the p policy of the organizational domain.
Yes. DMARC requires at least one of SPF or DKIM to pass for a message to be compliant. If you only have SPF configured, DMARC still works as long as SPF alignment passes. You should set up both SPF and DKIM for stronger protection because SPF alone breaks when email is forwarded.
Explore more inspectors
Protect your domain from email spoofing
DMARC+ monitors your DMARC reports, identifies unauthorized senders, and guides you to full enforcement.
Start Your 14-Day Trial Now