HTTPfy

DMARC Record Checker

Fetch and explain a DMARC record, and flag policy problems.

DMARC Record Checker Ready

About DMARC Record Checker

What the DMARC checker looks at

The checker queries the TXT record at _dmarc.<domain> through public DNS. If the exact name has none, it falls back to the organizational domain, the same discovery receivers use under RFC 7489 section 6.6.3. Split TXT strings are joined before parsing, so long records with several report addresses are read in full.

  • Record count: exactly one v=DMARC1 record. If there are two, receivers apply no policy at all.
  • Tag syntax: v comes first, p is present and is none, quarantine or reject, pct is 0 to 100, adkim and aspf are r or s, and fo uses only 0, 1, d and s.
  • Report URIs: every rua and ruf entry is a valid mailto: URI, with an optional size limit such as !10m.
  • External report authorization: when reports go to another organization (a DMARC reporting service, for example), the checker looks up <your-domain>._report._dmarc.<their-domain>. Without that record, receivers drop the reports (RFC 7489 section 7.1).

How to read the result

The summary shows the effective policy, the subdomain policy (inherited from p when sp is absent), the percentage and the alignment modes. Each tag is then listed with a plain-English meaning. Problems break DMARC or stop reports from arriving. Warnings are valid settings that leave you less protected than you could be, such as p=none or pct below 100.

Common problems

  • Stuck on p=none: monitoring mode is a starting point. Once aggregate reports show your real senders pass SPF or DKIM with alignment, move to quarantine and then reject.
  • Two records: usually one added by hand and one by an email provider's setup wizard. Merge them into one.
  • No reports arriving: the rua address has a typo, is missing mailto:, or points at a third-party domain that has not published the authorization record.
  • sp=none with a strict main policy leaves every subdomain open to spoofing.

To build a new record, use the DMARC Record Generator. To check the SPF and DKIM records that DMARC depends on, use Validate SPF Record and the DKIM Record Checker.