Free DMARC record checker
Look up the DMARC record on any domain, see the full record, and find out whether its policy is enforced. SPF and DKIM are checked too. No signup, no email address, no result held back.
Records are only half of it
Correct DNS still lands in spam more often than people expect. Inboxrise sends a test message to seed mailboxes and reports where it arrived (inbox or spam) before a campaign goes out.
Start a free trial →What this DMARC checker looks at
It looks up the TXT records at _dmarc.yourdomain.com and finds the one that starts with v=DMARC1, then reads its policy. It reads DNS only. It does not send an email, so it cannot tell you whether your mail reaches the inbox or the spam folder.
What a DMARC record is
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record that tells receiving servers what to do with mail that uses your domain in the From address but fails authentication. It builds on SPF and DKIM: a message passes DMARC when SPF or DKIM passes for a domain that matches the one in its From address.
How to read your record
A typical record looks like v=DMARC1; p=quarantine; rua=mailto:dmarc@acme.com. The parts:
v=DMARC1marks the record as DMARC. It has to come first.p=is the policy: what receivers should do with mail that fails.rua=is an address where mailbox providers send aggregate reports about mail using your domain. It is optional.
What a missing or weak policy means
p=quarantine asks receivers to treat failing mail as suspect, which usually means the spam folder, and p=reject asks them to refuse it. Either one counts as a pass here.
p=none asks receivers to take no action and only report, so the checker marks it Check. A record without a p= value it can read is marked Check too. With no enforced policy, anyone can put your domain in the From line and receivers have no instruction from you to act on it.
No DMARC record is a Fail. Google and Yahoo ask bulk senders to publish one, and p=none is enough to meet that.
How to add or fix a DMARC record
At your DNS host, add a TXT record with the name _dmarc (some hosts want the full _dmarc.yourdomain.com). A safe first value:
Use an address someone reads, or leave out rua= if you do not want the reports. Then make sure every service that sends as your domain, such as your mailbox provider, a newsletter tool or a CRM, passes SPF or DKIM. Once they do, change p=none to p=quarantine, and later to p=reject. Tightening it first means the policy applies to any of that mail that still fails.
A domain should have only one DMARC record. Edit the one you have rather than adding a second.
What this checker does not test
- DMARC reports. It does not read the aggregate reports sent to your
rua=address, which show the servers sending as your domain and whether they pass. - Alignment. Whether SPF and DKIM pass for the domain in your From address is decided message by message, so a DNS check cannot see it.
- The other tags. It reads
p=only, notsp=(the policy for subdomains),pct=,adkim=oraspf=. - A parent domain's record. Check a subdomain such as
mail.acme.comand it reads only_dmarc.mail.acme.com. Receivers fall back to the parent domain's record when a subdomain has none, so checkacme.comtoo. - A second DMARC record. Two records make receivers ignore DMARC for your domain. The checker reads the first one it finds and does not warn about another.
- Where your mail lands. No DNS check can tell you that.
After you change it
DNS changes can take a few hours to show up, so run the check again after you edit the record. DMARC is one of three records mailbox providers look for; the SPF, DKIM and DMARC checker explains all three, the SPF record checker has the SPF line for common providers, and SPF and DKIM explained, plus DMARC walks through setting them up.