Check any domain's DMARC record in seconds. The DMARC test parses the policy, alignment settings and reporting addresses, and flags misconfigurations that leave you open to email spoofing.
A record check is one moment in time. DMARCDECK watches your domain continuously — every sender classified as Authorized, Forwarder, or Threat, instant alerts when a spoofer appears, and a guided path to p=reject. Run the live spoofing test or start 30 days free.
DMARC (Domain-based Message Authentication, Reporting & Conformance, RFC 7489) is a DNS TXT record published at _dmarc.yourdomain.com. It ties SPF and DKIM together and tells receiving servers two things: what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it.
SPF and DKIM on their own only produce a pass or a fail. Neither tells Gmail or Outlook to act on that result, and neither checks that the domain the recipient actually sees in the From: line is the one that passed. DMARC closes both gaps, which is why it is the record that actually stops spoofing, and why Google and Yahoo now require it from bulk senders.
The p= tag is the policy. It is the part a DMARC check cares about most, because it decides whether your record protects anything.
| Policy | What receivers do with failing mail | Use it when |
|---|---|---|
| p=none | Deliver it normally, but send you reports. | You are discovering who sends as your domain. Monitoring only: no protection. |
| p=quarantine | Deliver to spam / junk. | Reports show your legitimate senders pass. The step before reject. |
| p=reject | Refuse the message at the SMTP level. | Every legitimate source is aligned. This is the goal state. |
The practical answer: a domain sitting on p=none is visible to you but not protected. Anyone can still send mail as you and it will be delivered. Treat p=none as a few weeks of observation, not a destination.
A record starts with v=DMARC1 followed by tags separated by semicolons. Only v and p are required.
| Tag | Meaning | Default |
|---|---|---|
| v=DMARC1 | Version. Must be first, exactly this value. | required |
| p= | Policy for the domain: none, quarantine or reject. | required |
| sp= | Policy for subdomains. | same as p |
| rua= | Where aggregate (daily XML) reports go. The tag you actually need. | no reports |
| ruf= | Where per-message failure reports go. Most large providers no longer send them. | none |
| pct= | Percentage of failing mail the policy applies to. Useful for a gradual rollout. | 100 |
| adkim= | DKIM alignment: r relaxed or s strict. | r |
| aspf= | SPF alignment: r relaxed or s strict. | r |
| fo= | When to generate failure reports (0, 1, d, s). | 0 |
| ri= | Requested reporting interval in seconds. | 86400 |
Enter your domain in the DMARC checker above. It looks up _dmarc.yourdomain.com, parses every tag, and flags the problems. To do a DMARC lookup by hand:
When you test a DMARC record, check five things in order: that exactly one record starting with v=DMARC1 exists, that p= is present and valid, that rua= points to a mailbox someone actually reads (or a service that parses the XML for you), that sp= is not weaker than you intend, and that pct= is not quietly left below 100.
Passing SPF or DKIM is not enough for DMARC. The domain that passed must also align with the domain in the visible From: header. This is the rule that stops a spoofer from passing SPF on their own domain and putting yours in the From line.
A message passes DMARC if either SPF or DKIM passes and aligns. Because SPF breaks when mail is forwarded, aligned DKIM signing on every sending service is what keeps legitimate mail passing once you enforce.
For most small businesses this takes two to six weeks. The slow part is reading raw XML reports, which is exactly what DMARCDECK does for you.
| Mistake | What happens |
|---|---|
| Two DMARC records | Receivers treat the domain as having no DMARC policy at all. |
| Record at the root domain instead of _dmarc. | Receivers never find it. The domain has no DMARC. |
| Staying on p=none for years | Reports, but zero protection: spoofed mail is still delivered. |
| No rua= | A policy with no visibility. You cannot safely tighten it. |
| rua= on another domain without authorisation | Reports are dropped unless that domain publishes a _report._dmarc authorisation record. |
| Enforcing before DKIM is aligned | Forwarded mail and third-party senders start landing in spam or bouncing. |
| Typos like p=rejected or missing semicolons | The record is invalid and ignored. |
Yes. A check tells you what your record says today; monitoring tells you who is actually sending as your domain every day. DMARCDECK gives one domain 30 days of full DMARC monitoring free, with no card: every sender classified as authorised, forwarder or threat, spoofing alerts within the hour, and a guided path to p=reject. After the trial it is $9 a month per domain.
Type your domain into the checker above. It queries the TXT record at _dmarc.yourdomain.com and tells you whether a record exists, what policy it sets, and what is wrong with it. You can also run dig TXT _dmarc.yourdomain.com.
For a domain that sends email: v=DMARC1; p=reject; rua=mailto:[email protected], reached after a monitoring period at p=none. For a domain that sends no email: v=DMARC1; p=reject; sp=reject.
No. p=none only asks for reports. Spoofed mail is still delivered. It is the right first step and the wrong place to stay.
As soon as DNS propagates, usually minutes to a few hours depending on the TTL. The first aggregate reports arrive within about 24 hours.
You can publish p=none first, since reports help you set up SPF and DKIM correctly. Before quarantine or reject, every legitimate sender needs aligned SPF or, better, aligned DKIM.
DMARC proves the mail is really from you; it does not decide whether the content is wanted. Reputation, content and engagement still affect inbox placement. Run the full Email Deliverability Audit to check the rest.
Checking all three at once, with a scored report: Email Deliverability Audit. In Lebanon and want it handled for you? See DMARC monitoring.