Check and validate DMARC records, prevent email phishing and spoofing, and generate custom DMARC policies
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that works with SPF and DKIM to protect your domain from email spoofing, phishing, and other cyber threats. It provides visibility into your email ecosystem and gives you control over how unauthenticated emails are handled.
DMARC records are essential for email security and brand protection because they:
A typical DMARC record looks like this:
v=DMARC1; p=quarantine; rua=mailto:reports@example.com; pct=100; adkim=r; aspf=r
Breaking down the components:
p=none (Monitor): No action taken on failed emails, but reports are generated. Recommended for initial setup to understand your email ecosystem without impacting delivery.
p=quarantine (Quarantine): Failed emails are marked as suspicious or sent to spam folders. Good intermediate step before full enforcement.
p=reject (Reject): Failed emails are rejected and not delivered. Provides strongest protection but requires confidence in your email authentication setup.
DMARC builds upon SPF and DKIM authentication:
Relaxed Alignment (r): Allows subdomains to pass. For example, email from mail.example.com passes for example.com. This is the default and most common setting.
Strict Alignment (s): Requires exact domain match. Only email from exactly example.com passes for example.com. More secure but can be restrictive.
Check and validate DMARC records in real-time with detailed policy analysis
Create custom DMARC policies with our guided generator tool
Get expert recommendations for optimal DMARC configuration
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that uses SPF and DKIM to determine the authenticity of email messages. It tells receiving servers how to handle unauthenticated emails and provides detailed reporting on email authentication activity. DMARC is published as a TXT record at _dmarc.yourdomain.com.
Enter your domain name in the DMARC checker tool above and click "Check DMARC Record". We'll automatically query _dmarc.yourdomain.com, retrieve your DMARC record, parse all tags and policies, validate the configuration, and display detailed results including any warnings or recommendations for improvement.
A basic DMARC record should look like: v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; pct=100. It must start with v=DMARC1, include a policy tag (p=), and should include at least one reporting address (rua=) to receive aggregate reports about email authentication.
p=none monitors emails without taking action - recommended for initial setup to understand your email ecosystem. p=quarantine marks suspicious emails as spam or sends them to junk folders. p=reject completely blocks unauthenticated emails - provides strongest protection but requires confidence in your setup.
You need at least one of them (SPF or DKIM) for DMARC to pass, but it's strongly recommended to have both configured. DMARC checks if either SPF or DKIM passes AND aligns with the From domain. Having both provides redundancy and stronger authentication, as DKIM can pass even if the email is forwarded (which often breaks SPF).
Add the DMARC record as a TXT record in your DNS settings with the hostname _dmarc (or _dmarc.yourdomain.com depending on your DNS provider). The record should contain your DMARC policy. For example, if your domain is example.com, add a TXT record at _dmarc.example.com. DNS changes typically take 24-48 hours to propagate.
Aggregate reports (rua=) are XML files sent daily by receiving mail servers that contain statistics about emails from your domain - how many passed/failed SPF and DKIM, source IPs, and volume. These help you understand your email ecosystem and identify authentication issues. Use a dedicated email or DMARC reporting service to process these reports.
Forensic reports (ruf=) are detailed, individual failure reports sent in real-time when an email fails DMARC authentication. They include message headers and can help diagnose specific problems. However, many receiving servers don't send forensic reports due to privacy concerns. Aggregate reports (RUA) are more commonly used and usually sufficient.
The pct= tag specifies the percentage of messages to apply the policy to, from 1-100. For example, pct=25 applies the policy to 25% of failed messages. This allows gradual rollout of stricter policies. Start with a low percentage when moving from p=none to p=quarantine or p=reject, then increase to 100% once confident.
After adding your DMARC record to DNS, it typically takes 24-48 hours for the record to propagate globally. Once propagated, receiving mail servers will immediately start checking your DMARC policy. However, you'll start receiving aggregate reports within 24-48 hours after propagation. Allow 2-4 weeks of monitoring with p=none before moving to stricter policies.