Use our free DMARC lookup tool to verify your domain's DMARC policy. Ensure proper email authentication and stop spoofing or phishing attempts
A DMARC lookup shows a domain's Domain-based Message Authentication, Reporting and Conformance policy. DMARC tells receiving mail servers what to do with messages that claim to be from the domain but fail authentication, and where to send reports about them. Enter a domain and this tool queries _dmarc. plus that domain for you and shows the published policy.
A message passes DMARC when SPF or DKIM passes and the domain it passed for aligns with the domain in the visible From address. If neither does, the receiver applies the domain's policy: deliver anyway (p=none), send to spam (p=quarantine) or refuse (p=reject). Receivers also send aggregate reports to the address in rua=, which show every source sending mail as your domain.
A typical record:
v=DMARC1; p=quarantine; rua=mailto:[email protected]; adkim=r; aspf=r| Tag | Meaning |
|---|---|
v=DMARC1 | Version. Required, and must be the first tag. |
p= | Policy for the domain: none (monitor only), quarantine or reject. Required. |
sp= | Policy for subdomains. If omitted, subdomains use p. |
rua= | Where to send daily aggregate reports, as mailto: addresses. |
ruf= | Where to send failure (forensic) reports. Few large mailbox providers send them. |
adkim= / aspf= | Alignment mode for DKIM and SPF: r relaxed (the default; mail.example.com aligns with example.com) or s strict (exact match). |
pct= | Percentage of failing mail the policy applies to, for gradual rollouts. Defaults to 100. |
fo= | When to generate failure reports, e.g. fo=1 if either SPF or DKIM fails. |
ri= | Requested interval between aggregate reports, in seconds (default 86400). |
v=DMARC1; p=none; rua=mailto:… and read the reports for a few weeks to find senders you missed.p=quarantine, optionally with pct below 100 at first.p=reject._dmarc.example.com, not on example.com itself.rua points outside your domain, the receiving domain must publish an authorization record such as example.com._report._dmarc.reports.example.net. Reporting services set this up for you.p=none. A monitoring policy protects nothing; it only produces reports. Plan the move to enforcement.Start with p=none and an rua address so you receive reports without affecting delivery. Move to quarantine and then reject once the reports show all legitimate mail passing.
quarantine asks receivers to treat failing mail as suspicious, usually delivering it to spam. reject asks them to refuse it during delivery, so it never reaches the recipient.
DMARC passes if either one passes and aligns, but you should have both. SPF breaks when mail is forwarded, and DKIM keeps DMARC passing in that case.
Since 2024 Gmail and Yahoo require a DMARC record (at least p=none) from anyone sending around 5,000 or more messages a day to their users. For everyone else it is strongly recommended, because without it anyone can send mail that appears to come from your domain.