Free tool
DMARC checker: policy, tags and the next step
Enter a domain to check its DMARC record.
Reads the TXT record at _dmarc.<domain> (or the parent domain's record for a subdomain) and every report address in it. Lookups go from your browser to Cloudflare's public DNS resolver.
- Where your policy sits: none, quarantine or reject
- Every tag explained for your record
- Report addresses and whether they can receive reports
- The corrected record and the next-step record
About this tool
About the DMARC checker
A valid record is one TXT record at _dmarc.<domain> that starts with v=DMARC1 and has a policy: p=none (reports only), p=quarantine (failing mail goes to spam) or p=reject (failing mail is refused). Gmail and Yahoo require one from bulk senders, and p=none is enough for that rule.
The checker explains every tag, checks that each report address can receive reports, shows where the policy sits on the path from none to reject, and writes the corrected record and the next-step record. The lookups run in your browser.
How it works
How to read the DMARC result
DMARC passes when SPF or DKIM passes with a domain that matches the From address. The record does not check anything itself: it tells receivers what to do when that match fails, and where to send reports about it.
- No record, two records, a record that does not start with v=DMARC1, or no p= (errors): receivers ignore DMARC; publish the starter record from the result
- p=none (warning): reports only; it meets the Gmail and Yahoo requirement and spoofed mail is still delivered
- p=quarantine and p=reject: failing mail goes to spam or is refused; pct below 100 applies the policy to part of the failing mail
- rua: where daily aggregate reports go; without it you cannot see which services send as your domain
- A report address on another domain needs that domain's permission (a TXT record at <your domain>._report._dmarc.<their domain>); report services add it for you, and the checker tests it
- adkim=s or aspf=s: strict alignment; mail signed or bounced through a subdomain of your sending tool fails, so relaxed (the default) is the usual choice
- Reports show a sender failing: give that service its own DKIM key on your domain; how to read the reports is in reading DMARC aggregate reports, and alignment fixes in fixing DMARC alignment failures
Background
From p=none to p=reject
- Start at p=none with a rua address and read two to four weeks of reports
- List every service that sends as the domain: mailboxes, sequencer, CRM, billing, support desk; each must pass SPF or DKIM with your domain aligned
- Move to p=quarantine; some teams use pct=25, then 50, then 100 on the way
- After a few clean weeks at quarantine, move to p=reject; keep reading the reports, because a new tool added later fails silently
- Cold email domains that only send through one mailbox provider can move faster: there is usually one sender to verify
Background
DMARC and the Gmail and Yahoo rules
Google asks senders of more than 5,000 messages a day to Gmail to publish DMARC (p=none is accepted) and to send with a From domain aligned with SPF or DKIM. Yahoo sets the same rule. What it means for cold email domains is in SPF, DKIM and DMARC for cold email.
DMARC depends on the other two records. Check the SPF record and the DKIM key of the same domain, or every record at once in the SPF, DKIM and DMARC checker.
Free guide19 min read
Send 100,000 cold emails a month
Domains and mailboxes you need, DNS, warm-up, lists, copy and follow-ups, with a launch checklist, sent to your inbox.
Questions
How do I check my DMARC record?
Enter the domain above. The checker reads the TXT record at _dmarc.<domain>, explains each tag and lists what to fix. By hand: dig TXT _dmarc.example.com or nslookup -type=txt _dmarc.example.com.
What is a good DMARC policy to start with?
v=DMARC1; p=none; rua=mailto:<a mailbox you read>. It changes nothing for delivery and sends you daily reports. Move to quarantine once every service that sends as your domain passes in the reports.
Is p=none enough for Gmail and Yahoo?
Yes. Their bulk sender rule asks for a DMARC record and accepts p=none, together with SPF and DKIM and a From domain aligned with one of them.
What does "DMARC quarantine/reject policy not enabled" mean?
A scanner found p=none. The record is valid; it only asks for reports. The message suggests moving to quarantine or reject once the reports show your own senders pass.
What is the difference between rua and ruf?
rua receives daily aggregate reports: counts of messages per sending IP and whether they passed. ruf receives copies of individual failing messages; few receivers send them.
Do subdomains need their own DMARC record?
No. A subdomain without its own record follows the parent domain's record: sp= if set, else p=. Publish a record on the subdomain only when it needs a different policy.
Why are my DMARC reports not arriving?
The rua address is missing or invalid, or it is on another domain that has not authorized your reports. The checker tests the authorization record for every external address.
Does this tool store the domains I check?
No. The lookups go from your browser to Cloudflare's public DNS resolver. We receive nothing unless you ask us to email you the fixes.
In your AI assistant
Run the same checks in Claude or ChatGPT
Free SKILL.md files with the rules behind this tool. Install them in Claude or Claude Code, or paste them into ChatGPT, Gemini, Grok or Cursor.
Mailboxes, warm-up and sending in one place
$2.50 a mailbox a month. DNS records are set for you, and every mailbox shows its warm-up numbers from day one.
Deliverability call
Talk to our deliverability team
Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change. Running 1,000+ mailboxes? We also quote a volume price below every vendor list price in our comparisons, warm-up and sending included.
- Review your domains, DNS records and current inbox placement
- Size the setup: domains, mailboxes per domain and daily volume per mailbox
- Plan warm-up and the move from your current provider or sequencer
- 1,000+ mailboxes: a volume price per mailbox for your setup
Free call
See open times in your time zone and book on this page.
Or open the booking pageLoading available times…
Open the booking page instead