In short
A DMARC checker reads the TXT record at _dmarc.yourdomain and tests it against RFC 9989, the DMARC standard published in May 2026. A valid record is the starting point: with the NCSC's Mail Check service retired on 31 March 2026, UK organisations need their own DMARC reporting to see whether their real email passes.
Get a quote for DMARC record check
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Check a domain's DMARC record
Enter a domain to look up its DMARC record, test the syntax and see what each tag means. The checker also looks up the domain's SPF record and, if you give a selector, its DKIM key.
What the DMARC checker tests
Enter a domain (or an email address at it) and the checker asks public DNS for three things: the DMARC record at _dmarc.yourdomain, the SPF record (opens in a new tab) on the domain itself and, if you give a selector, the DKIM public key. It then applies the rules in RFC 9989 section 4.7 (opens in a new tab), the current DMARC specification, and explains each finding in plain English.
- The record must start with v=DMARC1. RFC 9989 says the version tag must be first and exactly DMARC1; otherwise the whole record is ignored
- There must be only one record. If a lookup returns more than one DMARC record, receivers discard them all (RFC 9989 section 4.10 (opens in a new tab)), so the domain has no policy at all
- A missing p tag counts as p=none. An otherwise valid record without a policy is treated as monitoring only
- Unknown tags are ignored. A typo such as polcy=reject does nothing, so the checker flags it
- Removed tags are flagged for information. pct, rf and ri were removed in RFC 9989 and are now historic; appendix A.6 (opens in a new tab) explains that pct was usually not applied accurately except at 0 or 100, and the new t tag replaces it for testing
- Subdomains inherit. If a subdomain has no record of its own, receivers look for the organisational domain's record and apply its sp or np policy (section 4.10.1 (opens in a new tab)). The checker does the same and tells you which record applies
- Report addresses are checked. rua and ruf should be mailto: addresses, and addresses at another domain need that domain's permission (see below)
The result shows a policy badge (none, quarantine or reject) and a list of passes, warnings and errors. No record at all? The checker links straight to our DMARC generator so you can create one.
What each tag in your result means
The checker splits the record into its tag=value pairs and explains each one in the result. This is what it checks for each tag, and what receivers assume when the tag is left out:
| Tag | What the checker checks | If you leave it out |
|---|---|---|
| v | Present, first and exactly DMARC1 | The record is ignored |
| p | none, quarantine or reject; a missing p is flagged | Treated as p=none |
| sp | A valid policy; warns if sp=none while p is enforced | p applies |
| np | A valid policy (np is new in RFC 9989) | sp applies, or p if there is no sp |
| rua | mailto: addresses, and whether addresses at another domain are authorised | No aggregate reports, flagged as a warning |
| ruf | mailto: addresses and authorisation, with a note that failure reports can hold personal data | No failure reports |
| adkim, aspf | r (relaxed) or s (strict) | Relaxed |
| fo | 0, 1, d or s, and that a ruf address is set | 0 |
| t | y (test mode) or n | n |
| psd | y, n or u; warns on psd=y, which is for public suffix operators | u |
With t=y, a quarantine policy is applied as none and a reject policy as quarantine, and reports are unaffected. For every tag in full, with worked examples, see our guide to the DMARC record explained.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Example records and what the checker reports
These are typical records for a domain such as example.co.uk, and the verdict each one gets:
| Record at _dmarc.example.co.uk | Verdict | Why |
|---|---|---|
| v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk | Valid: monitoring | Reports flow and no mail is affected. RFC 9989 calls this Monitoring Mode |
| v=DMARC1; p=quarantine; rua=mailto:dmarc@example.co.uk | Valid: enforcement | Failing mail is treated as suspicious, typically delivered to spam or junk |
| v=DMARC1; p=reject; sp=reject; np=reject | Valid, with a warning | Enforced on every name, but with no rua there are no reports to show what is being refused |
| v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.co.uk | Valid: test mode | Receivers are asked to apply none while you check the reports |
| v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.co.uk | Valid, with a note | pct is historic under RFC 9989; use t=y to test instead |
| p=none; v=DMARC1; rua=mailto:dmarc@example.co.uk | Error | v=DMARC1 is not first, so the record is ignored |
| Two TXT records that both start v=DMARC1 | Error | Receivers discard both, so the domain has no DMARC policy |
A record of p=none is a healthy place to start, and RFC 9989 defines it as Monitoring Mode (opens in a new tab) when you are also receiving aggregate reports. The next step is to use those reports to move towards enforcement: see DMARC policy not enabled if a scanner has flagged your p=none record.
What DMARC reports add beyond a DNS check
A DNS check confirms what you have published. DMARC reports show what actually happens to your email. Once a record has a rua address, mailbox providers send aggregate reports: RFC 9990 (opens in a new tab) describes them as "daily (or more frequent) feedback reports" in XML, listing the servers that sent mail using your domain, how many messages each sent, and whether that mail passed SPF, DKIM and DMARC.
That is the information you need to:
- Find every service that sends as your domain, from Microsoft 365 or Google Workspace to your CRM, invoicing and marketing platforms
- Spot senders that fail authentication before you tighten the policy, so genuine mail keeps arriving
- See who is spoofing your domain, and how much of it receivers are already stopping
- Prove progress to your board, auditors or insurers as you move from p=none to quarantine and reject
The XML is hard to read by hand, which is why the NCSC recommends (opens in a new tab) using a tool to process it. The NCSC's own Mail Check service was retired on 31 March 2026 (opens in a new tab), so organisations that relied on it now need another way to read their reports. See DMARC reports for what is inside them, our DMARC report analyser guide, and DMARC management for the hosted platforms we supply.
Is DMARC record check the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Checking SPF and DKIM too
DMARC builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the domain it checked aligns with the domain in the visible From: address. RFC 9989 (opens in a new tab) recommends using both, so the checker looks at each:
| Check | Where the checker looks | Common findings |
|---|---|---|
| SPF | The TXT record starting v=spf1 on the domain itself | No record; more than one record; no all mechanism; more than 10 DNS lookups |
| DKIM | selector._domainkey.yourdomain, for the selector you enter | No key at that selector; an empty p= value (a revoked key); a key published through a CNAME by your sending service |
Two of those SPF findings break SPF outright: RFC 7208 (opens in a new tab) caps the include, a, mx, ptr, exists and redirect terms at 10 lookups in total, and returns a permanent error if a domain publishes more than one SPF record. To find a DKIM selector, open the headers of a message you sent and look for s= in the DKIM-Signature line. Our guide to SPF, DKIM and DMARC explained covers alignment in more detail.
Common results and how to fix them
These are the findings the checker reports most often, with the fix for each:
| What the checker says | What it means | What to do |
|---|---|---|
| No DMARC record found | Receivers have no policy for the domain and send no reports | Create a record at p=none with a rua address using the DMARC generator |
| Policy is none | Monitoring only: failing mail is still delivered | Read the reports, fix your senders, then plan the move up. See DMARC policy |
| No rua address | Nobody is sent aggregate reports | Add a reporting address, ideally from a DMARC monitoring platform |
| v=DMARC1 not first, or a syntax error | The record is ignored | Rewrite the record so it starts v=DMARC1; and uses tag=value pairs |
| More than one DMARC record | All of them are discarded | Merge them into one record and delete the rest |
| External report address not authorised | The reporting domain has not published permission, so receivers may not send to it | Ask the report provider to publish the authorisation record (DMARC services usually do this) |
| Messages still failing DMARC | A sender is not aligned with SPF or DKIM | Work through DMARC fail causes for that service |
The external address rule comes from RFC 9990 section 4 (opens in a new tab): if reports for example.co.uk go to an address at reports.example.net, receivers look for a TXT record at example.co.uk._report._dmarc.reports.example.net starting v=DMARC1 before they send anything.
How we help after your DMARC check
A clean result in the checker is a good start, and we can help with what comes next.
- Make sense of a failing result: we can explain each error or warning the checker shows and what to change in your DNS to fix it
- Check the rest of your domains: we can review the records on all your domains, parked ones included
- Set up reporting: we can connect your domains to a monitoring platform so the daily reports are collected and readable
- Choose the platform: we can supply EasyDMARC, Valimail or the Check Point Email Security DMARC Management add-on, and help you pick the one that suits your senders
Licences can be billed monthly, with terms confirmed at quote. Contact us for free advice.
Frequently asked questions
Is this DMARC checker free?
Yes. The checker is free to use for any domain, as often as you like. It runs in your browser and asks a public DNS-over-HTTPS (opens in a new tab) resolver for the records, so the domain you enter is not sent to this website.
How do I check if DMARC is enabled on a domain?
Enter the domain in the checker above. If it finds a valid record starting v=DMARC1, DMARC is published. Check the p tag too: p=none means the domain is in monitoring mode, while quarantine or reject means receivers are asked to act on mail that fails. You can also run nslookup -type=TXT _dmarc.example.co.uk on Windows, or dig TXT _dmarc.example.co.uk on macOS and Linux.
How long until a new DMARC record shows up?
A brand-new record usually appears as soon as your DNS host publishes it. A changed record can take longer, because resolvers keep the old answer until its time to live (TTL) runs out, which can be several hours. After that, the NCSC says (opens in a new tab) the first reports from major email providers arrive within 24 hours.
Does Gmail check DMARC?
Yes. Google's email sender guidelines (opens in a new tab) say that anyone sending 5,000 or more messages a day to personal Gmail accounts must publish DMARC (p=none is acceptable) and align the From: domain with SPF or DKIM, and that every sender must use SPF or DKIM. Google also recommends setting up DMARC reports. See DMARC sender requirements for Google, Yahoo and Outlook.com.
Can I check a subdomain?
Yes. Enter the subdomain, such as mail.example.co.uk. If it has its own _dmarc record, the checker reads that. If not, it looks up the organisational domain's record, as receivers do, and shows which sp or np policy applies to the subdomain.
Why does the checker mention pct?
pct was a tag for applying a policy to a percentage of mail. RFC 9989, published in May 2026, removed it and lists it as historic, because it was rarely applied accurately except at 0 or 100. Use t=y (test mode) instead while you check the effect of a new policy.
Still have a question about DMARC record check?
Ask us and a member of our team will get back to you.