DMARC record checker

What DMARC is, what the p=none, quarantine and reject policies mean, why it matters for stopping spoofing of your domain, and how to reach p=reject without blocking your legitimate mail. With a free, instant check of any domain.

FREE TOOL · NO SIGN-UP

Check your domain’s DMARC now

Enter your domain and our email-authentication analyser reviews your DMARC record together with SPF and DKIM in seconds: whether it exists, which policy applies and what still needs tuning. The analysis is instant and we don’t store your domain.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email-authentication standard that tells receiving servers what to do with messages that claim to come from your domain but fail the SPF or DKIM checks. It is published as a TXT record in DNS under _dmarc.yourdomain.com. DMARC does not replace SPF and DKIM: it builds on them and adds two key pieces — alignment (the visible "From:" domain must match the authenticated domain) and reporting that tells you who is sending on your behalf.

What a DMARC record looks like

A typical starter record is:

v=DMARC1; p=none; rua=mailto:[email protected]; fo=1

The most important tags: v=DMARC1 (version, required), p= (policy: none, quarantine or reject), rua= (address for daily aggregate reports), pct= (percentage of mail the policy applies to, useful for phased rollout), sp= (policy for subdomains) and adkim/aspf (alignment mode, r relaxed or s strict). Without rua you lose report visibility — which is exactly what makes DMARC useful.

p=none, p=quarantine and p=reject explained

The p= policy is the heart of DMARC:

· p=none — monitoring mode. No action is taken on failing mail; reports are only collected. It is the starting point to see who sends on your behalf without risking deliverability.
· p=quarantine — mail that fails authentication and alignment is treated as suspicious and usually lands in the spam folder.
· p=reject — failing mail is rejected at the server and never delivered. This is the end goal: only p=reject (or quarantine) actually protects your domain from direct spoofing. A permanent p=none does not protect: it only reports.

Why does DMARC matter?

Without an enforcing DMARC policy (quarantine or reject), anyone can send email with your domain in the "From:" and impersonate your brand: phishing, CEO fraud (BEC) and scams against your customers. DMARC at reject cuts direct domain spoofing off at the root. It also improves deliverability (mailboxes trust authenticated domains more), and since 2024 Google and Yahoo require DMARC from bulk senders (more than 5,000 messages a day): without it, your legitimate mail can be rejected or sent to spam.

How to go from p=none to p=reject without breaking mail

The key is to do it in phases, guided by the reports:

1. Publish p=none with rua and let 1-2 weeks of aggregate reports come in.
2. Identify every legitimate source (your own server, your marketing ESP, billing, CRM, support tools…) and fix SPF and/or DKIM for each until it aligns under DMARC.
3. Move to p=quarantine, optionally with a low pct= (for example pct=25) and raise it gradually.
4. Once you go weeks with no legitimate failures, switch to p=reject with pct=100.

Never jump straight to reject without reviewing the reports first: the risk is knocking out transactional mail or vendors that don’t align yet.

Frequently asked questions about DMARC

How do I check whether my domain has DMARC?

You can look up the TXT record at _dmarc.yourdomain.com, or use our free analyser: enter your domain and it instantly tells you whether a DMARC record exists, which policy (p=) applies and whether SPF and DKIM are correctly aligned.

Is p=none enough?

No. p=none is only for monitoring and collecting reports; it does not protect against spoofing. It is a good starting point, but the goal is to reach p=quarantine and then p=reject in a controlled way.

Can DMARC make me lose legitimate mail?

Only if you move to quarantine or reject before aligning all your sending sources. That is why rollout is phased, reviewing the aggregate (rua) reports to make sure all your legitimate mail passes SPF or DKIM with alignment before you tighten the policy.

Do I need SPF and DKIM to use DMARC?

Yes. DMARC builds on SPF and DKIM and checks alignment between the authenticated domain and the visible sender domain. You need at least one of them aligned for a message to pass DMARC; having both is recommended.

Sources and references

Updated: July 2026 · Informational content; not professional advice.

Keep learning

Monitor your email authentication continuously

Sign up free at OCIRIA Security and get alerts when your DMARC, SPF or DKIM changes or stops protecting your domain.

Sign up free Talk to us