DMARC Record Checker
Validate your DMARC policy and email authentication configuration
About DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the final layer in the email authentication stack. It builds on SPF and DKIM by adding a policy that tells receiving servers what to do when authentication fails and providing visibility into your email authentication ecosystem through aggregate reports.
A DMARC record specifies your authentication policy (monitor, quarantine, or reject), alignment settings for SPF and DKIM, and email addresses where ISPs send reports. These reports are invaluable for understanding who is sending email as your domain and catching spoofing attempts or misconfigurations.
Organizations typically start with p=none to monitor authentication without affecting mail delivery, then gradually increase enforcement to p=quarantine and finally p=reject once they've confirmed all legitimate email passes authentication. Use this tool to validate your DMARC configuration.
Frequently Asked Questions
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM to prevent email spoofing. It tells receiving servers what to do when emails fail authentication and where to send reports.
What do the DMARC policies p=none, p=quarantine, and p=reject mean?
p=none monitors authentication failures without taking action (good for initial setup). p=quarantine sends failing emails to spam. p=reject blocks failing emails entirely. Start with p=none, then progress to quarantine and reject as you gain confidence.
What is the rua tag in DMARC?
The rua= tag specifies email addresses where ISPs send aggregate reports about your domain's authentication results. These daily or weekly reports show which servers are sending email as your domain and whether they pass or fail authentication.
How long does DMARC take to work?
DMARC takes effect immediately after DNS propagation (typically 5-30 minutes). However, aggregate reports from ISPs arrive after 24-48 hours, so allow a few days to see the full picture of your email authentication landscape.