DMARC Record Checker
Enter a domain to look up its DMARC DNS record and see how it's configured.
What is a DMARC record?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record published at_dmarc.yourdomain.com. It tells receiving mail servers what to do with messages that claim to be from your domain but fail SPF or DKIM alignment, and where to send reports about those failures. Without it, receiving servers fall back to their own judgment — which means spoofed mail from your domain can land in an inbox looking completely legitimate.
How to read the result
The checker parses the raw record into its individual tags. The two that matter most arep — the policy applied to failing mail (none, quarantine, orreject) — andrua, the address aggregate reports are sent to. pct limits enforcement to a percentage of mail, which is useful for a gradual rollout to reject.
Common failure causes
- No record published at all — the domain has never set up DMARC.
- Two DMARC records exist for the same domain, which receivers treat as invalid and ignore entirely.
- The policy has sat at
p=nonefor years with no plan to move to enforcement, leaving the domain unprotected against spoofing. - Missing
rua, so failures never get surfaced to anyone.
Frequently asked questions
What does a DMARC policy of p=none mean?
p=none is monitor-only. Mail that fails SPF or DKIM alignment is still delivered as normal, but the domain owner starts receiving aggregate reports showing who is sending mail as that domain. It is the standard first step before moving to quarantine or reject.
What is the rua tag for?
rua sets the mailbox address (or addresses) that receives daily aggregate reports — machine-readable XML summaries of every sending source seen for the domain, and whether each one passed or failed authentication. Without rua, DMARC still enforces the policy but you get no visibility into who is sending as you.
Does publishing DMARC alone stop spoofing?
Only once the policy reaches quarantine or reject, and pct is at 100. A record stuck at p=none blocks nothing — it only reports. Getting from none to reject safely requires reviewing aggregate reports first to confirm every legitimate sender is authenticated.
How often should I re-check my DMARC record?
Any time you add or remove an email sending service (a new marketing platform, help desk, or CRM), because each one needs to be covered by SPF or DKIM alignment before you tighten the policy. Otherwise a monthly check is enough to catch DNS changes made by a registrar or hosting migration.
Keep an eye on this automatically
A one-off check tells you how things look right now. DMARC.WS collects your aggregate reports continuously, shows you which senders are failing authentication, and alerts you when something changes.
Free plan includes 5 domains. No card required.