Free · live registry data · no login
DMARC Record Checker
Policy, alignment and reporting addresses, explained.
How it works
DMARC checker: policy, alignment and reporting, explained in plain words
We query _dmarc.yourdomain over live DNS, confirm there is exactly one v=DMARC1 record and break it down tag by tag: the policy (p), subdomain policy (sp), rollout percentage (pct), aggregate and forensic report addresses (rua, ruf) and SPF/DKIM alignment modes (aspf, adkim). Each setting is graded, typos and unknown tags are flagged, and you get a 0–100 score plus the concrete change that would raise it, whether that is adding a report address or moving from p=none to quarantine.
Results appear here after you click Check DMARC.
How this works
- 1
Query _dmarc TXT
The _dmarc subdomain is fetched live and only records starting with v=DMARC1 are considered.
- 2
Parse every tag
The record is split on semicolons into tag=value pairs and each is validated against RFC 7489.
- 3
Grade the policy
Policy strength, reporting, rollout percentage and alignment combine into a score and concrete next step.
Frequently asked questions
- What does p=none mean in DMARC?
- p=none asks receivers to report authentication results but take no action on failures. It is the correct starting point: you learn which services send as your domain before any mail is blocked.
- Should I use quarantine or reject?
- Quarantine sends failing mail to spam; reject refuses it outright. Move to quarantine once reports show all legitimate mail passes, then to reject after a few more weeks without surprises.
- What is the rua address for?
- rua receives daily aggregate XML reports from Gmail, Microsoft, Yahoo and others showing which IPs sent mail as your domain and whether SPF and DKIM passed. It is the only way to see spoofing attempts.
- Why does DMARC need alignment?
- SPF and DKIM can pass for a domain different from the visible From address. Alignment requires the authenticated domain to match the From domain, which is what actually stops spoofing.
- Do I need DMARC if I only send a little mail?
- Yes. The requirement from Gmail and Yahoo targets bulk senders, but DMARC protects every domain from being spoofed in phishing, and low-volume domains are favourite targets precisely because owners rarely check.
Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.