DMARC Record Check

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the layer that ties SPF and DKIM together and tells receivers what to do when authentication fails. Every domain that sends email should publish a DMARC record. Use the form below to look up the DMARC policy of any domain.

What DMARC does

DMARC lives at _dmarc.example.com as a TXT record. It answers three questions: (1) should receivers require SPF, DKIM, or both to align with the visible From address? (2) what should receivers do with mail that fails? (3) where should aggregate reports about failures be sent? A domain with p=reject, aligned SPF, and aligned DKIM is effectively immune to being spoofed.

The three DMARC policies

• p=none — monitoring mode. Receivers report on failures but do not reject anything. This is the right first step when rolling out DMARC.
• p=quarantine — receivers should treat failing mail as suspicious, typically delivering it to spam.
• p=reject — receivers should refuse failing mail outright. This is the endgame for any domain that cares about its brand.

Reading the record

A DMARC record starts with v=DMARC1 and lists policy tags separated by semicolons. Look for p= (the policy), rua= (aggregate report address), ruf= (forensic report address, optional), and pct= (percentage of failing mail to which the policy applies). If pct is less than 100 the domain is still ramping up enforcement.