NetKit

DMARC checker

Look up a domain's DMARC record and get every tag explained: the policy, subdomain policy, alignment mode and where reports go.

DMARC
Try:

We query the TXT record at _dmarc.<domain>.

A safe path to p=reject

  1. Publish SPF and DKIM for every service that sends as your domain (your mailbox provider, newsletter tool, CRM, helpdesk).
  2. Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com and read the aggregate reports for two to four weeks.
  3. Fix any legitimate source that fails alignment.
  4. Move to p=quarantine; pct=25, then 100, then p=reject.

Check the pieces with the SPF checker and DKIM checker.

Questions people ask

What is DMARC?
Domain-based Message Authentication, Reporting and Conformance (RFC 7489) tells receivers what to do when mail claiming to be from your domain fails SPF and DKIM alignment, and where to send reports. It lives in a TXT record at _dmarc.yourdomain.
Do I need DMARC?
Yes, if you send email. Since February 2024 Google and Yahoo require bulk senders (over 5,000 messages a day to their users) to publish DMARC with at least p=none, and every domain benefits from protection against spoofing.
p=none, quarantine or reject?
Start with p=none and a rua address to collect reports without affecting delivery. Once reports show all legitimate sources pass, move to quarantine (spam folder), then reject.
What does alignment mean?
SPF or DKIM passing isn't enough: the domain they authenticate must match the visible From: domain. Relaxed alignment (default) allows subdomains; strict (aspf=s, adkim=s) requires an exact match.