DMARC Record Checker

Enter a domain and the checker queries the TXT record at _dmarc.yourdomain.com. It parses the tags, then reports the policy (p=), the subdomain policy (sp=), the policy for subdomains that do not exist (np=), the testing flag (t=), the SPF and DKIM alignment modes (aspf= and adkim=), and any report addresses in rua= and ruf=. Warnings sit next to the raw record so you can see which tag caused them.

The same run also checks SPF, DKIM, MX and blacklists, so you get a graded overview. The DMARC result is listed first on this page. That is the only difference from the main checker.

p=none tells receivers to take no action on mail that fails DMARC. It is a monitoring mode, and the checker warns on it because nothing is enforced. p=quarantine asks receivers to treat failures as suspicious, which usually means the spam folder. p=reject asks them to refuse the message during the SMTP conversation.

Receivers make the final call. A policy is a request from the domain owner, and large mailbox providers mostly honor it, but nobody can promise what every receiver does. Moving from none to reject is a change you make in steps: read the aggregate reports, find every legitimate sender that fails, fix those, then tighten.

DMARC does not only ask whether SPF or DKIM passed. It asks whether the passing domain matches the domain in the visible From header. SPF is checked against the envelope sender, and DKIM against the d= domain in the signature. If your ESP signs with its own domain and uses its own bounce domain, both can pass and DMARC still fails.

The aspf and adkim tags set how strict the match is. Relaxed, the default, accepts any subdomain of the same organizational domain. Strict requires an exact match. Most senders should leave both relaxed. If you send through Amazon SES, setting a custom MAIL FROM domain and enabling Easy DKIM on your own domain is what gets you aligned.

A missing rua= means you get no aggregate reports, and without those you are enforcing blind. A subdomain policy weaker than the main policy leaves a gap attackers can use. If t=y is set, receivers are told not to enforce, so a reject policy does nothing until you remove it. A missing np= on an enforcing policy is flagged because spoofing from made-up subdomains stays open.

The checker also flags pct= below 100. That tag used to let you apply a policy to a share of failing mail. The DMARCbis revision retires it in favor of t=y, so treat a partial pct as something to clean up, not a rollout plan.

It reads DNS. It does not read your aggregate reports, so it cannot tell you which senders are failing. It also does not test inbox placement, and a clean DMARC record is not a deliverability guarantee. It is one input that mailbox providers weigh with reputation, content and complaint rates.