Free DMARC Record Checker

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It builds on two existing email authentication standards — SPF and DKIM — by adding a policy layer that tells receiving mail servers what to do when authentication fails.

Without DMARC, a spammer can send emails that appear to come from your domain, and the receiving server has no guidance on whether to deliver, quarantine, or reject those messages. DMARC closes this gap by publishing a policy in your DNS that explicitly defines how failures should be handled.

Since February 2024, Google and Yahoo require DMARC records for domains sending more than 5,000 emails per day. Microsoft followed with similar requirements. Not having DMARC now directly impacts your email deliverability.

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. Here's what each tag means:

• v=DMARC1 — Version identifier (required, must be first) • p=none|quarantine|reject — Policy for the domain (required) • sp= — Policy for subdomains (optional, inherits from p= if absent) • rua= — Aggregate report recipients (mailto: URIs) • ruf= — Forensic report recipients (mailto: URIs) • adkim=r|s — DKIM alignment mode (relaxed or strict) • aspf=r|s — SPF alignment mode (relaxed or strict) • pct= — Percentage of messages subject to policy (1-100) • fo= — Forensic report options (0, 1, d, s) • ri= — Aggregate report interval in seconds (default 86400)

Rolling out DMARC safely requires a phased approach:

1. Start with p=none — This monitoring-only mode lets you collect reports without affecting email delivery. Publish: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

2. Analyze reports — Use aggregate reports to identify all legitimate email sources (marketing platforms, CRM, transactional services). Ensure each source passes SPF or DKIM.

3. Move to quarantine — Once legitimate sources are authenticated, set p=quarantine with a low pct= value (e.g., pct=10) to gradually route failing emails to spam.

4. Enforce with reject — After confirming no legitimate email is affected, set p=reject to block all unauthenticated email. This is the strongest protection against domain spoofing.

5. Monitor continuously — Keep rua= reports active. New email services or infrastructure changes can break authentication. Regular monitoring catches issues before they affect deliverability.