DMARC Record Checker
Parse and validate the DMARC record at _dmarc.yourdomain per RFC 9989: policy strength, np, t, rua/ruf, alignment modes and external report authorization.
Your query is sent only to the resolver shown; this site keeps no logs. Copy link to this result
What this checks
Reads _dmarc.<domain> TXT, validates tags per RFC 9989 §4.7 (DMARCbis; RFC 7489 records are still accepted), walks up to parent domains when the name has no record (DNS tree walk, §4.10) and checks that external report domains authorize your domain (§11.6).
Rates policy strength: none → quarantine → reject. The legacy pct tag was removed in RFC 9989 (App. A.6) and is ignored; use t=y for testing.
If it fails
- No record: publish v=DMARC1; p=none; rua=mailto:… and read reports for 2–4 weeks before tightening.
- p=none: move to quarantine (add t=y while you test), then reject. The pct tag was removed in RFC 9989 (App. A.6).
- External rua missing authorization: ask the report provider or add the _report._dmarc record they specify.
FAQ
What does p=none do?
Nothing to mail flow — it only requests reports so you can see who sends as your domain.
What are rua and ruf?
rua: aggregate XML reports (daily); ruf: per-message failure reports, rarely sent today.
Relaxed vs strict alignment?
Relaxed accepts subdomains matching the organizational domain; strict requires an exact match.
Does DMARC need both SPF and DKIM?
One aligned pass is enough, but having both avoids failures on forwarding.