About this tool
DMARC (RFC 9989, the current standard, which replaced RFC 7489) tells receiving mail servers what to do when a message claims to be from your domain but fails authentication, and where to send reports about it. It is a TXT record at _dmarc.yourdomain.
A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) the domain in the visible From address.
How to read the results
- p — policy
none: only report.quarantine: treat failing mail as suspicious (spam folder).reject: refuse it.- sp — subdomain policy
- Applies to subdomains without their own record. Defaults to p.
- np — non-existent subdomain policy
- New in RFC 9989: applies to subdomains that do not exist in DNS. Defaults to sp.
- adkim / aspf — alignment
r(relaxed, default): the authenticated domain may be a subdomain of the From domain (same organisational domain).s(strict): must match exactly.- rua — aggregate reports
- Where daily XML summaries are sent. Reports to another domain need an authorisation record at that domain.
- ruf — failure reports
- Per-message reports; few providers send them.
- pct — percentage
- Share of failing mail the policy applies to. Removed in RFC 9989 but still seen; newer receivers may ignore it.
- fo — failure reporting options
- When to send failure reports: 0 (all fail, default), 1 (any fails), d (DKIM fails), s (SPF fails).
Limitations
- If a domain has no record, parent domains are checked the way receivers discover an organisational policy (tree walk). The top-level domain itself is not queried.
- This tool reads the published policy. It cannot see whether your real mail passes — that is what the rua reports are for. To test one message, use the e-mail header analyzer.
- DKIM cannot be verified from a domain name alone, because keys are published under selectors that are not discoverable. Enter a selector in the DKIM lookup to check a key.
Frequently asked questions
What DMARC policy should I start with?
Start with p=none and an rua address, review the reports for a few weeks, fix any legitimate senders that fail, then move to quarantine and finally reject.
Do I need both SPF and DKIM?
DMARC needs only one of them to pass with alignment, but set up both: SPF fails on forwarding, and DKIM can break when mailing lists modify messages. Having both makes delivery more robust.
Why are my reports going to a third party not arriving?
The receiving domain must publish yourdomain._report._dmarc.theirdomain TXT "v=DMARC1". This checker tests that automatically for every external rua/ruf address.
Is DMARC required?
Google and Yahoo require a DMARC record (at least p=none) for bulk senders since 2024, and many security frameworks expect p=quarantine or reject.
Where is the DMARC record?
A TXT record at _dmarc.yourdomain.
What is the best DMARC policy?
p=reject, reached step by step after monitoring with p=none.
What does rua mean?
The address that receives daily aggregate reports.
Does DMARC stop all phishing?
It stops exact-domain spoofing, not look-alike domains.