What Is a DMARC Record?
A DMARC record (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.yourdomain.com that tells receiving mail servers what to do when emails fail SPF and DKIM authentication checks. DMARC is the policy layer of email authentication — it ties SPF and DKIM together with enforcement rules (none, quarantine, or reject) and enables reporting so you can monitor who is sending email on behalf of your domain.
Our free DMARC checker goes beyond basic DMARC lookup. It parses every DMARC tag with human-readable descriptions, evaluates policy strength, checks DKIM and SPF alignment modes, validates aggregate and forensic reporting URIs, analyzes subdomain policy, and runs 11 validation checks to give you a comprehensive DMARC health score. Whether you're troubleshooting email deliverability, auditing email security, or implementing DMARC for the first time, this tool provides instant DMARC record validation.
How to Check DMARC Record (3 Methods)
There are several ways to check DMARC records for any domain. Our online DMARC checker is the fastest and most thorough method, but command-line tools work for quick lookups.
nslookup -type=txt _dmarc.example.com. Look for the TXT record starting with v=DMARC1. This shows the raw DMARC record but doesn't validate policy or check alignment.dig _dmarc.example.com TXT +short for a quick DMARC lookup. For all DNS record types, use our DNS Lookup tool.DMARC Record Tags — Complete Reference
A DMARC record consists of tag-value pairs separated by semicolons. Each tag controls a different aspect of email authentication policy. Understanding these tags is essential for a proper DMARC check.
Required tag. Specifies what to do with failing emails: none (monitor), quarantine (spam), or reject (block).
Policy for subdomains. If not set, inherits from p. Set separately when subdomains need different policies.
Email address(es) for aggregate XML reports. Format: rua=mailto:[email protected]. Essential for monitoring.
Email for forensic failure reports. Contains details about individual failed emails. Optional; not all providers support it.
DKIM and SPF alignment mode. r = relaxed (subdomains OK), s = strict (exact match). Default is relaxed.
Percentage of emails to apply policy to (1-100). Use for gradual rollout: start at 10%, increase to 100%. Default is 100%.
Understanding DMARC Policies
Our 11 DMARC Validation Checks
DMARC vs SPF vs DKIM — The Email Authentication Trio
DMARC is the policy and reporting layer that ties SPF and DKIM together. Without DMARC, even if you have SPF and DKIM configured, receiving servers have no clear instructions on what to do with failing emails. Here's how they compare:
What: Verifies the sending server's IP is authorized
How: DNS TXT record listing allowed IPs
Checks: Envelope sender (Return-Path)
Check SPF Record →What: Verifies the message wasn't tampered with
How: Cryptographic signature in email headers
Checks: Message integrity + signing domain
Check DKIM Record →What: Ties SPF + DKIM together with policy
How: DNS TXT record at _dmarc.domain
Checks: From header alignment + enforcement
You are hereDMARC Implementation Roadmap: From Monitoring to Enforcement
Implementing DMARC is a phased process that protects your brand from email spoofing without disrupting legitimate email delivery. Start with p=none to collect data about email authentication results. Analyze aggregate reports (rua) to identify all legitimate email sources and ensure they pass SPF and DKIM. Gradually move to p=quarantine with a low percentage (pct=10) and increase as confidence grows. Finally, implement p=reject with pct=100 for full enforcement.
DMARC Best Practices for Email Security
- Start with p=none and gradually enforce
- Always configure rua for aggregate reports
- Set up both SPF and DKIM before DMARC
- Use pct tag for gradual policy rollout
- Monitor aggregate reports regularly
- Set subdomain policy (sp) explicitly
- Consider strict alignment for maximum security
- Target p=reject as the ultimate goal
Related Email & DNS Tools
Check SPF records, DNS lookup count, and include chain resolution.
Verify DKIM signatures and public key DNS records.
Check MX records and detect email providers for any domain.
Check all DNS record types (A, AAAA, CNAME, MX, TXT, and more).
Run 17 DNS health checks including SPF and DMARC validation.
Check if your mail server IP is blacklisted on major RBLs.