DMARC Checker
Use this DMARC checker to read the DMARC record of a domain. It shows the policy, the percentage it applies to, where reports go and the alignment settings, with advice on anything weak or wrong.
The Uptrack server reads the records through the public DNS resolver of Cloudflare and follows every include for you. A check can take a few seconds.
Try an example
DMARC checker: what the result shows
- Policy (p)
- What receivers do with mail that fails: none (only monitor), quarantine (send to spam) or reject (refuse).
- Subdomain policy (sp)
- The policy for subdomains. If it is missing, subdomains follow p.
- Percent (pct)
- The share of failing mail the policy applies to. The default is 100.
- Reports (rua, ruf)
- Addresses that receive aggregate and failure reports. Without rua you cannot see who sends as your domain.
- Alignment
- Relaxed lets a subdomain of the From domain pass. Strict needs an exact match.
DMARC policy: from none to reject
Start with p=none and read the reports. They show every service that sends as your domain. Fix the ones that fail SPF or DKIM, then move to quarantine, and then to reject. You can raise pct in steps to limit the risk.
Gmail and Yahoo have required a DMARC record from bulk senders since 2024. A domain with no record, or with p=none, gets no protection from spoofing.
DMARC record errors and warnings
- No DMARC record
- The record must sit at _dmarc.yourdomain.com as a TXT record that starts with v=DMARC1.
- No p tag
- The policy is required. Receivers ignore a record without it.
- Two records
- Only one is allowed. Receivers ignore the policy when there are several.
- A weaker subdomain policy
- If sp is weaker than p, attackers can spoof a subdomain.
Frequently asked questions
What is a DMARC record?
A DMARC record is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do with mail that fails SPF and DKIM and where to send reports about it.
What does p=none mean in DMARC?
It only monitors. Mail that fails DMARC is still delivered, and you receive reports. It is the right first step, but it gives no protection against spoofing.
Should my DMARC policy be quarantine or reject?
Reject is the strictest and the goal for most domains. Move there once the reports show that all your legitimate mail passes. Quarantine is a safe step in between.
Where do DMARC reports go?
To the addresses in the rua tag of the record. They are XML files sent about once a day by the big mailbox providers. A report tool or a mail service can read them for you.
Does a subdomain need its own DMARC record?
No. A subdomain follows the policy of the main domain unless it has its own record. The sp tag sets a different policy for all subdomains at once.
Monitor this email DNS record every minute
Uptrack checks your SPF, DKIM, DMARC and MX records on a schedule and alerts you when one changes or stops resolving.
Plans from $3/mo, with a 30-day money-back guarantee.