Email

DMARC Record Lookup

DMARC Policy

Look up a domain's DMARC policy

Reads the TXT record at _dmarc.<domain>, parses every tag, and checks the policy, alignment, reporting addresses and subdomain handling.
Evaluate as
Subdomains inherit the sp tag when the record publishes one — a domain at p=reject with sp=none is still wide open below the apex.

DNS Resolver

Most domains return the same records on every resolver — the choice matters during DNS propagation, or when a filtering resolver blocks a domain.

No domain checked yet

Enter a domain above to see its DMARC policy, how strictly SPF and DKIM must align, and where aggregate reports are sent.

Tool features

Comprehensive DMARC record analysis and email authentication validation
4 checks

Full tag breakdown

Every published tag plus the defaults receivers apply, each with what it actually does

Alignment simulation

How your own servers, an ESP, a forwarded message and a spoofed sender fare under this policy

Enforcement stage

Where the domain sits on the none → quarantine → reject path, including partial pct rollouts

Share & export

Share the result or download a branded PDF, CSV, JSON or zone-file record

What is a DMARC record & how it works

How a domain tells receivers to handle mail that fails authentication

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the email policy that ties SPF and DKIM together. Published as a TXT record at _dmarc.yourdomain.com, it tells receiving mail servers what to do with messages that fail authentication — monitor, quarantine, or reject — and where to send reports.

This lookup fetches and parses your DMARC record, showing the enforcement policy, alignment modes, reporting addresses, and percentage covered. It flags the two states that leave a domain exposed: no DMARC record at all, and a record stuck on p=none, which monitors but never actually blocks spoofed mail.

p= policy
The enforcement action: none (monitor only), quarantine (send to spam), or reject (block outright).
Alignment
Whether the SPF/DKIM domain matches the visible From domain. Strict or relaxed alignment controls how closely.
rua / ruf
The addresses that receive aggregate (rua) and forensic (ruf) DMARC reports about your mail.

How to use this tool

Check a domain's DMARC policy in four steps
1
Enter a domain name
Type the domain whose DMARC policy you want to inspect, e.g. example.com.
2
Run the lookup
We query the _dmarc TXT record and parse each tag in the policy.
3
Review the policy
Check the enforcement level (p=), alignment, coverage, and reporting addresses.
4
Strengthen enforcement
Move from p=none toward quarantine or reject once your legitimate mail passes authentication.

Related tools

Keep debugging with tools from the same suite
5 tools
DMARC Generator
Generate DMARC policy records for email authentication with policy configuration options
DMARC Report (RUA) Analyzer
Summarize DMARC aggregate (RUA) report XML: sending sources, SPF/DKIM alignment, volumes, and spoofing signals
SPF Lookup
Check Sender Policy Framework (SPF) records for email authentication and mail server authorization
DKIM Lookup
Find DomainKeys Identified Mail (DKIM) records for email message signing and verification
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records

Frequently asked questions

Common questions about DMARC records
5 Q&A

p=none is monitor-only: receivers still deliver mail that fails DMARC, but send you reports. It's the safe starting point, but it provides no protection — the goal is to progress to quarantine or reject.

Quarantine tells receivers to treat failing mail as suspicious (usually routing it to spam). Reject tells them to refuse it outright. Reject is the strongest protection against spoofing of your domain.

Yes. DMARC builds on SPF and DKIM — a message passes DMARC when it passes SPF or DKIM and the authenticated domain aligns with the From domain. Without them, DMARC has nothing to enforce.

They are daily XML summaries from receiving servers showing which sources sent mail as your domain and whether it passed authentication — invaluable for finding legitimate senders before you enforce.

If your policy is p=none, receivers won't block spoofed mail. You also need SPF and DKIM aligned for all legitimate senders, then raise the policy to quarantine or reject to actually stop spoofing.