DMARC Record Checker

Check, validate and understand your DMARC record: instantly review any domain's syntax, policy, alignment, and reporting tags.
Please enter a valid domain name, without http:// prefix

How to Use the DMARC Checker

1

Enter Domain

Enter your domain name without the http:// prefix (e.g., company.com).

2

Click Check DMARC

Initiate the live DNS mapping process by clicking the primary lookup action button.

3

Review Results

Analyze your detailed security posture and the clean tag-by-tag record breakdown.

The tool works on any domain. You do not need to own it to run a check.

What Your DMARC Check Results Mean

Your result falls into one of three categories. Here’s how to read each one and what to do next.

DMARC Record Found

Valid

A valid result means your domain publishes a correctly formatted _dmarc TXT record that mail receivers can read and act on. Check the policy (p=) value, because it determines whether the record actually protects you:

  • p=none Monitoring-only. You’re collecting reports, but receivers take no action against spoofed mail, so the domain is not yet protected against abuse. Once you’ve reviewed your reports and confirmed your legitimate senders are aligned, move to quarantine or reject. See our hosted DMARC option to manage this transition safely.
  • p=quarantine Failing mail is sent to spam/junk. Partial enforcement.
  • p=reject Failing mail is blocked outright. This is full enforcement and the recommended end state.
How your p= policy protects you A spoofed email fails DMARC — watch where it lands at each level.
Spoofed email fails DMARC
Inbox Spoof still delivered
Spam / Junk Quarantined
Blocked Spoof rejected
Protection Monitoring only — not yet protected

DMARC Record Found

Invalid

An invalid result means a record exists but contains errors that prevent it from working as intended. The most common causes:

  • Missing mandatory tags. Every record must begin with v=DMARC1 and include a p= policy tag. If either is absent, the record fails validation.
  • Syntax errors. Tags must be semicolon-separated with no stray characters. A misplaced space, missing semicolon, or duplicate tag will break parsing.
  • Malformed RUA/RUF addresses. Reporting addresses must use the mailto: prefix (e.g. rua=mailto:[email protected]). A bare email address without mailto: is invalid.

Fix the specific error, or regenerate a clean record from scratch using our free DMARC record generator tool.

No DMARC Record Found

Unprotected

No record means your domain has no DMARC protection at all. The implications:

  • The domain is unprotected against spoofing and impersonation, and anyone can send mail that appears to come from you.
  • You are non-compliant with Google and Yahoo bulk sender requirements, which can cause your legitimate mail to be rejected or filtered.

What is a DMARC Record?

A DMARC record is a DNS TXT record that tells receiving mail servers how to handle emails that fail DMARC authentication. It builds on SPF and DKIM by defining your domain's email authentication policy and providing instructions for reporting authentication results.

A DMARC record is published as a DMARC DNS record at the _dmarc subdomain of your domain. For example, if your domain is example.com, the record is stored at:

_dmarc.example.com

The record itself is stored as a DMARC TXT record containing a series of tags and values that define your policy, reporting preferences, and alignment settings.

When a receiving mail server gets an email claiming to come from your domain, it:

  • Checks SPF and DKIM.
  • Verifies whether either passes DMARC alignment.
  • Reads your DMARC record.
  • Applies the policy you've published.

Depending on your configuration, emails that fail authentication can be:

Monitoredp=none
Sent to spamp=quarantine
Rejectedp=reject

DMARC also allows mailbox providers to send reports back to the domain owner, helping identify legitimate email sources, unauthorized senders, and configuration issues.

What is DMARC Guide

DMARC Record Example

A DMARC record can be as simple or as detailed as your deployment requires. Below are some common examples.

Basic DMARC record p=none 
v=DMARC1; p=none;
This sets up DMARC without affecting email delivery.
DMARC monitoring Reporting 
v=DMARC1; p=none; rua=mailto:[email protected];
This records authentication results and sends aggregate reports to the specified email address. Still offering no protection at this point.
Partial enforcement p=quarantine 
v=DMARC1; p=quarantine; pct=50; rua=mailto:[email protected];
Half of the messages that fail DMARC are quarantined, allowing organizations to transition gradually toward enforcement.
Full enforcement p=reject 
v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=s; aspf=s;
This provides the strongest protection by rejecting unauthenticated emails while enabling aggregate and forensic reporting with strict alignment.

Need to create your own record? Build a valid DMARC policy for your domain.

DMARC Record Format & Syntax Rules

A DMARC record follows a specific syntax. Even small formatting mistakes can cause mailbox providers to ignore the record.

Important rules
  • Every record must begin with v=DMARC1.
  • Tags are separated using semicolons (;).
  • The record must be published as a TXT record under the _dmarc subdomain.
  • Only one DMARC record should exist for each domain. Having multiple DMARC records can cause validation failures.
  • After the required v tag, the remaining tags can appear in any order.
  • DMARC tag names are case-insensitive, although using lowercase consistently is recommended.

For example, this is a correctly formatted record:

v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s;

DMARC Record Tags Explained

Tag What is does Example value Optional/Required
v Protocol version. Must be the first tag. v=DMARC1 Required
p Policy for the main domain to instruct how receivers handle failing mail. p=reject Required
rua Address(es) for aggregate (summary) reports. rua=mailto:[email protected] Optional (recommended)
ruf Address(es) for forensic (per-failure) reports. ruf=mailto:[email protected] Optional (recommended)
sp Policy for subdomains. Defaults to the p value if omitted. sp=quarantine Optional
np Policy for non-existent subdomains (DNS returns NXDOMAIN). Closes a subdomain-spoofing gap. np=reject Optional
adkim DKIM alignment mode adkim=s Optional
aspf SPF alignment mode aspf=r Optional
t Testing mode (RFC 9989). Asks receivers to apply the next less strict policy. t=y Optional
psd Public suffix domain flag, used during the DNS Tree Walk. Most domains should omit it. psd=y Optional
fo Forensic reporting options, when failure reports are generated. fo=1 Optional

How to Find Your DMARC Record

Pick the path that matches your result:

Using nslookup 
nslookup -type=TXT _dmarc.yourdomain.com
Using dig 
dig TXT _dmarc.yourdomain.com

If a valid DMARC record exists, these commands will return the TXT record published under your domain. If no record is returned, your domain may not have DMARC configured.

Next Steps After Your DMARC Check

Pick the path that matches your result:

No record found?

Create a valid DMARC record in under 2 minutes with the free generator — no manual editing required.

DMARC Generator →

At p=none? Move to enforcement.

PowerDMARC's hosted DMARC guides you safely from monitoring to full p=reject enforcement with real-time visibility.

Hosted DMARC →

Want ongoing monitoring?

PowerDMARC automatically parses aggregate reports and alerts you when new senders appear or authentication issues arise.

Start Free →

Want ongoing monitoring instead of one-off checks? PowerDMARC automatically parses your DMARC aggregate reports and alerts you when issues arise. 

10,000+

ORGANISATIONS WORLDWIDE

100+

FORTUNE 100 & GOVERNMENTS

130+

COUNTRIES SERVED

DMARC checkerDMARC checker

Frequently Asked Questions

Is the DMARC checker free?
Yes. You can check any domain's DMARC record for free, with no sign-up required.
Do I need to own the domain I'm checking?
No. DMARC records are published in public DNS, so you can check any domain.
How often should I check my DMARC record?
Check after any DNS or email configuration change, before launching a campaign, and periodically as part of routine email security hygiene.
Why does my domain show "no DMARC record" when I just added one?
DNS changes can take time to propagate. Wait for the TTL to expire (often up to a few hours) and check again.
What's the difference between a valid record and an enforced one?
A valid record is correctly formatted, but if its policy is p=none it only monitors and doesn't block spoofed mail. Enforcement means p=quarantine or p=reject.
What does a DMARC record look like?
A DMARC record is a DNS TXT record containing tag-value pairs separated by semicolons. Every valid record starts with v=DMARC1, followed by a policy such as p=none, p=quarantine, or p=reject. Optional tags can define reporting addresses, alignment settings, and enforcement percentages. Example: v=DMARC1; p=quarantine; rua=mailto:[email protected];
Where is a DMARC record stored?
A DMARC record is stored as a TXT record at the _dmarc subdomain of your domain. For example, the DMARC record for example.com is published at: _dmarc.example.com
How do I add a DMARC record to my DNS?
You'll need access to your DNS hosting provider. Create a new TXT record under the _dmarc host and publish your DMARC policy. For a complete walkthrough, see our guide on how to publish a DMARC record.

Use our Free DMARC Record Checker Today!

Book a demo Start 15-day trial