DMARC record checker
Read a domain's DMARC policy in plain English, check where its reports go, and find what stands between it and full protection.
A domain, an email address or a URL. Lookups go from your browser to Cloudflare's public DNS (1.1.1.1); nothing is sent to simmail.
What a DMARC record is
DMARC (RFC 7489) ties SPF and DKIM to the address people actually see: the From header. A message passes DMARC when SPF or DKIM passes for a domain aligned with the From domain. The domain owner publishes a TXT record at _dmarc.example.com that says what receivers should do with mail that fails (p=none, quarantine or reject) and where to send reports about it.
The tags this checker reads: p (policy), sp (policy for subdomains), pct (share of failing mail the policy applies to), rua and ruf (aggregate and failure report addresses), adkim and aspf (relaxed or strict alignment), fo (when to send failure reports) and ri (the requested report interval).
Why it matters
Without DMARC, anyone can put your domain in the From line, and SPF and DKIM on their own don't stop it. Since February 2024, Gmail and Yahoo require a DMARC record (at least p=none) from bulk senders, and a From domain aligned with SPF or DKIM. With p=quarantine or p=reject, spoofed mail goes to spam or is refused; that is also what BIMI logos require.
Common mistakes
- Staying at p=none forever. It is a monitoring mode. Read the reports, fix your legitimate senders, then move to quarantine and reject, using
pctto step up gradually. - No rua address. Without reports you can't see which services send as you, so you can't safely tighten the policy.
- External report addresses without authorisation. If reports go to another domain, that domain must publish an authorisation record, or receivers won't send them.
- Two DMARC records. Receivers then ignore DMARC for the domain entirely.
- The record on the wrong name. It belongs at
_dmarc.example.com, not atexample.com. Watch for DNS panels that append the domain twice. sp=noneunder an enforcing policy. It leaves every subdomain open to spoofing.
This tool finds the organizational domain with a built-in list of common suffixes such as co.uk, rather than the full Public Suffix List, so treat inheritance results for unusual suffixes as a guide. To write a new record, use the DMARC generator.
Questions
Is p=none enough for Gmail and Yahoo?
For the 2024 bulk-sender rules, yes: they require a DMARC record, and p=none counts. But p=none only monitors. It does not stop anyone spoofing your domain, so plan to move to quarantine and then reject.
What do rua and ruf do?
rua is where receivers send daily aggregate reports: which IPs sent mail as your domain and whether it passed. ruf asks for per-message failure reports, which many large receivers don't send.
Why do reports to another domain need an extra record?
To stop anyone flooding a stranger with reports, RFC 7489 7.1 makes receivers check that the report domain agrees. The report domain publishes v=DMARC1 at yourdomain._report._dmarc.theirdomain. Reporting services do this when you add your domain.
My subdomain has no DMARC record. Is it protected?
Usually. Receivers fall back to the record at the organizational domain (for mail.example.com, that is example.com) and apply its sp= policy, or p= if there is no sp. This checker shows when a record is inherited.
What is alignment?
DMARC passes when SPF or DKIM passes for a domain that matches the From domain. Relaxed alignment (the default) accepts a subdomain of the same organizational domain; strict (adkim=s, aspf=s) needs an exact match.
Your DNS is right. Now see how real people react to your email
simmail sends your app's mail to simulated people who open, ignore, junk, click and reply, so you can test what happens after delivery. Start free, no card.