DMARC Checker
Read a domain's DMARC record in plain English: what happens to mail that fails, where reports go, and what is stopping you from tightening the policy.
What DMARC adds on top of SPF and DKIM
DMARC relates a passing SPF or DKIM identity to the visible From domain through alignment. Strict alignment requires an exact domain match; relaxed alignment uses the applicable organizational domain. This DNS checker does not independently authenticate an email message.
The published policy requests handling of failing messages and can request reports. Receivers can apply local rules and may not send reports, so a report set is not a complete inventory of all mail.
The three policies
p=none: request monitoring without DMARC enforcement.p=quarantine: request suspicious handling for failing mail.p=reject: request rejection of failing mail after legitimate senders are reviewed.
Provider requirements distinguish all senders and bulk senders. Consult the current requirements for your recipients. RFC 9989 removed pct and introduced optional t test handling. Older receivers may interpret records differently; no percentage or delivery outcome is guaranteed.
Moving from none to reject safely
- Publish
p=nonewith arua=report address. - Review representative reports and actual messages from every legitimate sending service.
- Fix the services that fail, usually by adding DKIM in their settings.
- Choose enforcement based on that evidence, keep the prior record and monitor the effect after each change.
Limitations
- We read the published record. Whether a given message passes depends on how it was sent; check a real message with the Email Header Analyzer.
- Policy discovery uses a bounded RFC 9989 parent tree walk. Report-destination authorization compares registered domains using the bundled suffix data. This is not a complete simulation of every receiver, and older implementations can use different discovery rules.
Questions
Where do I read the reports?
Aggregate reports arrive as zipped XML files, which are hard to read by hand. Most people send them to a DMARC report service, many of which have a free tier, and read the summaries there.
Should I use ruf (forensic reports)?
Few large receivers send them any more because they can contain personal data. rua aggregate reports are what you need.
What do adkim and aspf mean?
They set how closely domains must match. Relaxed (r, the default) lets mail.example.com match example.com. Strict (s) needs an exact match. Relaxed is right for almost everyone.