DMARC checker
Reads your DMARC record tag by tag, shows where you sit on the none, quarantine, reject ladder and gives you the record for the next step.
Next
What the DMARC checker does
DMARC is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do with mail that fails authentication and where to send reports about it. The checker fetches the record and explains each tag in it, from the policy in p and sp to the report addresses in rua and ruf and the alignment modes in adkim and aspf.
It also checks the report addresses. If your rua address is on another domain, the DMARC reporting standard, RFC 9990, requires that domain to publish an authorization record at yourdomain.com._report._dmarc.otherdomain.com. Without it, receivers don't send your reports there. The checker confirms the record exists.
How DMARC decides
A message passes DMARC when SPF or DKIM passes and the domain it checked aligns with the From address. Relaxed alignment, the default, accepts any domain with the same organizational domain, so mail.example.com aligns with example.com. Strict alignment needs an exact match.
When a message fails, the policy applies:
- p=none: deliver as usual and report. Right for the first weeks.
- p=quarantine: treat it as suspicious, which usually means the spam folder.
- p=reject: refuse it during the SMTP session.
sp sets the policy for subdomains, which inherit p when sp is missing, and np sets one for subdomains that don't exist. t=y marks the policy as a test and asks receivers to apply one level below it, so quarantine acts as none and reject acts as quarantine.
t replaces pct. RFC 9989, the DMARC standard published in May 2026, retired pct because receivers applied values other than 0 and 100 unreliably.
How to read and fix the result
The checker places your policy on the none, quarantine, reject ladder and flags what blocks the next step.
- No rua tag. Add rua=mailto: with an address you read, or a reporting service. Without reports you can't see which senders would fail when you tighten the policy.
- Policy stuck at p=none. It meets the Gmail and Yahoo bulk sender rule but protects nothing. Once reports show every real sender passing, move to quarantine, then reject.
- Syntax. v=DMARC1 must be the first tag, and the domain can have only one DMARC record. With two, receivers discard both, which leaves the domain without a policy.
Why it matters for cold email
Gmail requires a DMARC record from anyone sending around 5,000 or more messages a day to personal Gmail accounts. Yahoo requires one from bulk senders without publishing a number, and Microsoft from senders of 5,000 or more a day to Outlook.com. p=none is enough to comply, as long as the From domain aligns with SPF or DKIM.
Sending domains need their own record. A lookalike domain bought for outreach can be spoofed like any other, and an enforced policy makes that spoofing fail. Move each sending domain to quarantine or reject once a test message shows dmarc=pass for your inboxes.