DMARC checker

Reads your DMARC record tag by tag, shows where you sit on the none, quarantine, reject ladder and gives you the record for the next step.

Example: ken.so, checked cached 10 min

DMARC enforced

p=rejectReports on

ken.so rejects mail that fails DMARC. This is the goal: spoofed mail never reaches the inbox. 8 checks: 7 pass, 0 warn, 0 fail.

v=DMARC1; p=reject; sp=reject; np=reject; adkim=r; aspf=r; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1; t=n; psd=n;

8 checks7 pass0 warn0 fail

Policy

p=reject

Failures are refused

Subdomains

sp=reject

Set in the record

Alignment

Relaxed

adkim=r, aspf=r

Aggregate reports

1 address

Delivered

Rollout

From monitoring to reject. RFC 9989 uses t=y for the test step, not pct.

p=noneStart here and read two weeks of aggregate reports.

p=quarantine with t=yOnce the reports show only your own senders. t=y asks receivers to treat failures as p=none while you watch.

p=quarantineAfter two weeks of clean reports in test mode.

p=rejectAfter two more clean weeks. This is the goal.

Nothing left to tighten. Keep reading the reports for new senders before you add one.

7 passed, 1 optional

Nothing to do here. Open it to see the evidence for each one.

One recordSyntaxp=rejectReportsReport authorizationSubdomainsRFC 9989 tagsruf

ShowHide

One DMARC record

Exactly one TXT record at _dmarc starts with v=DMARC1. Two would make receivers ignore both.

_dmarc.ken.so

Valid syntaxRFC 9989

Every tag parses and v=DMARC1 comes first.

125 characters

Enforced, the strongest policyp=reject

Mail that fails DMARC is refused. Spoofers can't use your domain.

failures are refused

Aggregate reports on

Receivers send daily reports to [email protected].

1 address

Reports stay on your domain

Every report address is on your own domain, so no authorization record is needed.

Subdomains covered

Subdomains get sp=reject.

sp=reject

Current tags only

No historic pct, rf or ri tags. The record reads the same to old and new receivers.

Failure reports requested

ruf asks for per-message failure reports. Few receivers send them, and they can contain personal data.

1 address

Every tag

What each tag tells receivers. Defaults are what they apply when a tag is left out.

Tag

What it means

v=DMARC1

Marks this TXT record as a DMARC policy.

p=reject

Mail that fails DMARC is refused outright.

sp=reject

For subdomains: Mail that fails DMARC is refused outright.

np=reject

For subdomains that do not exist: Mail that fails DMARC is refused outright.

t=n

Not in test mode: the policy applies as written.

rua=mailto:[email protected]

Where receivers send daily aggregate (XML) reports about who sends as you.

ruf=mailto:[email protected]

Where receivers send per-message failure reports. Few receivers send them.

adkim=r

Relaxed DKIM alignment: a subdomain of the From domain also counts.

aspf=r

Relaxed SPF alignment: a subdomain of the From domain also counts.

fo=1

When to send failure reports: 0 when everything fails, 1 when anything fails, d on DKIM failure, s on SPF failure.

psd=n

This domain is its own organizational domain, for itself and its subdomains.

DMARC record generator

Then

DMARC report analyzer

Email me this report

The verdict, every tag explained, the next record to paste and a saved link that stays live for 90 days.

Full report as HTMLRecords, copy-paste readySaved link for 90 days

Ken checks DMARC on every domain it sends from.

Connect your domains and Ken keeps SPF, DKIM and DMARC right while it warms and sends.

Start free - 1,000 credits, no card

What the DMARC checker does

DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do with mail that fails authentication and where to send reports about it. The checker fetches the record and explains each tag in it, from the policy in p and sp to the report addresses in rua and ruf and the alignment modes in adkim and aspf.

It also checks the report addresses. If your rua address is on another domain, the DMARC reporting standard, RFC 9990, requires that domain to publish an authorization record at yourdomain.com._report._dmarc.otherdomain.com. Without it, receivers don't send your reports there. The checker confirms the record exists.

How DMARC decides

A message passes DMARC when SPF or DKIM passes and the domain it checked aligns with the From address. Relaxed alignment, the default, accepts any domain with the same organizational domain, so mail.example.com aligns with example.com. Strict alignment needs an exact match.

When a message fails, the policy applies:

p=none: deliver as usual and report. Right for the first weeks.
p=quarantine: treat it as suspicious, which usually means the spam folder.
p=reject: refuse it during the SMTP session.

sp sets the policy for subdomains, which inherit p when sp is missing, and np sets one for subdomains that don't exist. t=y marks the policy as a test and asks receivers to apply one level below it, so quarantine acts as none and reject acts as quarantine.

t replaces pct. RFC 9989, the DMARC standard published in May 2026, retired pct because receivers applied values other than 0 and 100 unreliably.

How to read and fix the result

The checker places your policy on the none, quarantine, reject ladder and flags what blocks the next step.

No rua tag. Add rua=mailto: with an address you read, or a reporting service. Without reports you can't see which senders would fail when you tighten the policy.
Policy stuck at p=none. It meets the Gmail and Yahoo bulk sender rule but protects nothing. Once reports show every real sender passing, move to quarantine, then reject.
Syntax. v=DMARC1 must be the first tag, and the domain can have only one DMARC record. With two, receivers discard both, which leaves the domain without a policy.

Why it matters for cold email

Gmail requires a DMARC record from anyone sending around 5,000 or more messages a day to personal Gmail accounts. Yahoo requires one from bulk senders without publishing a number, and Microsoft from senders of 5,000 or more a day to Outlook.com. p=none is enough to comply, as long as the From domain aligns with SPF or DKIM.

Sending domains need their own record. A lookalike domain bought for outreach can be spoofed like any other, and an enforced policy makes that spoofing fail. Move each sending domain to quarantine or reject once a test message shows dmarc=pass for your inboxes.

Questions

What does p=none mean in DMARC?

Monitor only. Receivers deliver failing mail as usual and send you reports. It satisfies the Gmail and Yahoo requirement for bulk senders, but it doesn't stop anyone from spoofing your domain.

Is p=none enough for Gmail and Yahoo?

Yes, for their bulk sender rules. They need a DMARC record with at least p=none and a From domain aligned with SPF or DKIM. Quarantine or reject is better protection, not a requirement.

What is the rua tag in DMARC?

The address that receives aggregate reports, written as rua=mailto:[email protected]. Receivers send a daily XML summary of the mail they saw from your domain, by source IP and result. An address on another domain only works if that domain publishes the authorization record RFC 9990 describes.

Why does DMARC fail when SPF and DKIM pass?

Alignment. SPF may have passed for your sending tool's bounce domain, and DKIM may have been signed with the tool's own domain. Neither matches your From address, so DMARC fails. Set up DKIM with your domain in that tool.

What is the difference between rua and ruf?

rua receives aggregate reports: counts by source and result, with no message content. ruf receives failure reports about single messages, which can include headers and content. Many large providers don't send failure reports at all, for privacy reasons, so rua is the one to set up.