DMARC checker
Check the DMARC record of any domain: its policy for mail that fails, where reports go and the next record to publish. A subdomain inherits its parent's policy, and the checker follows that too. Free, with no sign-up.
DMARC record of lumen-advisory.example
This is an example for a made-up domain. Type your own domain above to check it.
DNS for this domain is managed at Cloudflare. Make the changes there.
DMARCDMARC is set to p=none, so mail that fails the checks is still delivered.Warning
p=none meets the minimum that Gmail and Yahoo ask of bulk senders, but anyone can still send mail as your domain.
What we found
v=DMARC1; p=none; rua=mailto:dmarc@lumen-advisory.exampleHow to fix it
When DKIM is on for every service that sends as this domain, replace the record with this one.
- Type
- TXT
- Name
_dmarc.lumen-advisory.example- Value
v=DMARC1; p=quarantine; rua=mailto:dmarc@lumen-advisory.example
Publish it as a TXT record at _dmarc.lumen-advisory.example, in place of any DMARC record already there.
Reports go to dmarc@lumen-advisory.example. Create that mailbox, or change the address to one you read.
Many DNS panels want only the part before your domain: @ for the domain itself, _dmarc for DMARC.
A DMARC record tells receivers what to do when SPF and DKIM both fail.
DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It passes when SPF or DKIM passes for the domain in the From address. When both fail, the policy decides: deliver the mail (p=none), put it in spam (p=quarantine) or refuse it (p=reject).
The record is one TXT record at _dmarc.<your domain>. A subdomain without its own record uses its parent's record.
Each DMARC tag does one thing, and only v= and p= are required.
- v=DMARC1
- Marks the record as DMARC. It must come first.
- p=
- The policy for mail that fails: none, quarantine or reject.
- sp=
- The policy for subdomains, when it differs from p=.
- rua=
- Where receivers send daily summary reports, as mailto: addresses.
- ruf=
- Where some receivers send copies of single failures. Many large receivers do not send these.
- pct=
- The share of failing mail that the policy applies to. 100 is the default.
- adkim= and aspf=
- How closely the DKIM and SPF domains must match the From domain: r (relaxed, the default) or s (strict).
Move from p=none to p=reject in three steps.
Start with p=none and a reports address
Mail is still delivered, and the reports show every service that sends as your domain.
Fix what the reports show
Switch DKIM on in each service you use, and add the services you keep to SPF.
Move to p=quarantine, then p=reject
When the reports show only your own services passing, tighten the policy. Follow the reports for a few weeks after each step.
Common questions about DMARC
What is DMARC?
DMARC is a DNS record that tells receiving servers what to do with mail that fails SPF and DKIM for your domain, and where to send reports about it. With p=quarantine or p=reject, it keeps others from sending mail in your domain's name to receivers that check DMARC.
What does a DMARC checker show?
The domain's DMARC record, or its parent's record when the domain has none, its policy, where reports go and the next record to publish.
Is p=none enough?
It meets the minimum that Gmail and Yahoo ask of bulk senders, but it does not stop anyone from sending mail as your domain. Use it to read the reports, then move on.
What happens if a domain has two DMARC records?
Receivers expect one record. With two, they skip DMARC for the domain, as if there were none.
Do I need a reports address?
It is not required, but without rua you cannot see who sends mail as your domain, so you cannot know when it is safe to tighten the policy.
Does DMARC protect the mail I send to other companies?
DMARC protects your own domain from use by others. Whether your mail reaches the inbox also depends on SPF, DKIM, your content and how recipients respond.