×Atomic Mail

Atomic Mail

Productivity

Get
Products
↓
Features
↓
BusinessPricingBlogContact usSupport
Sign InSign Up
Download app
Sign inCreate a free account
  1. Home
  2. Free email tools
  3. DMARC checker
Free tool · No signup · Updated for RFC 9989

Free DMARC Checker

Look up and test any domain’s DMARC record. See the policy, what every tag means, where reports go and exactly what to fix next.

How it works

How to check a DMARC record

A DMARC lookup takes a few seconds. You don’t need access to the domain, because DMARC records are public.

  1. Enter the domain

    Type a domain like yourcompany.com. You can also paste a website address or an email address; only the domain is used.

  2. Read the verdict

    See whether a DMARC record exists, which policy it sets and what each tag means, in plain language.

  3. Fix and check again

    Follow the next steps, or open the record in the DMARC generator to change it. Then run the check again.

Example with a sample domain, not a live result.
Results explained

What your DMARC check result means

Every check ends in one of these results. Here’s what each one means and what to do about it.

ResultWhat it meansWhat to do
Enforced: rejectReceivers are asked to refuse mail that fails DMARC. This is full protection against exact-domain spoofing.Keep reading your reports and set up SPF or DKIM for every new service before it sends.
Enforced: quarantineFailing mail should go to spam. Most spoofing is stopped, but some of it still reaches users.When reports show no legitimate mail failing, move to p=reject.
DMARC policy not enabledThe record uses p=none. It collects reports, but receivers deliver failing mail as normal.Use the reports to fix your senders, then move to quarantine.
No DMARC record foundThere’s no valid TXT record at _dmarc.yourdomain or a parent domain. Receivers have no instructions and you get no reports.Publish a starter record with p=none and a report address.
Invalid recordSomething exists, but it doesn’t start with v=DMARC1 or the policy is malformed, so receivers can’t apply it.Rebuild it with the generator and replace the old record.
More than one recordTwo or more DMARC records at the same name. Receivers ignore all of them.Delete the extras so only one remains.
Couldn’t checkThe DNS lookup failed or timed out. This says nothing about whether a record exists.Try again in a minute.

What this check tells you

  • Whether a valid record exists, including one inherited from a parent domain.
  • Which policy applies to the domain, its subdomains and non-existent subdomains.
  • Where reports go and whether outside report domains have authorized them.

What it can’t tell you

  • Whether your mail passes alignment. Check a real message with the Email Header Analyzer.
  • Whether reports are being read or acted on.
  • Inbox placement, which also depends on reputation and content.
The basics

What is DMARC and how does it work?

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do when a message claims to come from your domain but can’t prove it.

SPF checks the server

SPF lists the servers allowed to send mail for a domain. It checks the hidden envelope sender, not the From address people see.

Server permission

DKIM checks the signature

DKIM adds a cryptographic signature that proves the message wasn’t changed and names the domain that signed it.

Message signature

DMARC checks they match

DMARC passes only if SPF or DKIM passes and its domain matches the From address. Your record says what happens when it fails.

Alignment + policy

What DMARC protects against

  • Exact-domain spoofing: mail that forges your domain in the From address, the kind used for phishing and fake invoices.
  • Blind spots: aggregate reports show every server sending as your domain, including services you forgot about.
  • Bulk sender rules: Gmail, Yahoo and Microsoft require a DMARC record from anyone sending 5,000+ messages a day to their users.

What it doesn’t cover

  • Lookalike domains such as yourcompany-billing.com. DMARC only protects the exact domain.
  • Display name tricks, where the name looks right but the address is someone else’s.
  • Inbox placement. DMARC helps receivers trust your mail, but content and reputation still matter.
Examples

DMARC record examples and syntax

A DMARC record is a single TXT record at _dmarc.yourdomain.com. These examples use example.com; replace it with your own domain and report address.

p=none

Starter: monitor only

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Collects reports without affecting delivery. Use it for the first few weeks.

p=quarantine

Partial enforcement

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Failing mail goes to spam. Move here once your reports show your own mail passing.

p=reject

Full enforcement

v=DMARC1; p=reject; np=reject; rua=mailto:dmarc-reports@example.com

Failing mail is refused, including mail from subdomains that don’t exist.

Syntax rules

  • Start with v=DMARC1, exactly like that, as the first tag.
  • Separate tags with semicolons. Spaces after them are fine.
  • Publish one TXT record at the host _dmarc. Most DNS panels add your domain automatically.

Common mistakes

  • Two DMARC records after switching providers. Receivers then ignore both.
  • Host set to _dmarc.example.com.example.com because the panel already appends the domain.
  • Report addresses without mailto:, which makes them invalid.
Reference

DMARC tags explained

DMARC was updated in 2025 by RFC 9989, which replaced RFC 7489. It added three tags and removed three. Many guides still list the old ones as current.

TagWhat it doesValues and default
v RequiredMarks the record as DMARC. Must be first.DMARC1
p RequiredPolicy for mail that fails DMARC.none, quarantine, reject
spPolicy for subdomains.Same values. Default: the value of p
np NewPolicy for subdomains that don’t exist in DNS.Same values. Default: the value of sp
ruaWhere to send aggregate (daily summary) reports.mailto: addresses, comma-separated
rufWhere to send failure reports about single messages.mailto: addresses. Rarely sent
adkimHow closely the DKIM domain must match the From domain.r relaxed (default) or s strict
TagWhat it doesValues and default
aspfHow closely the SPF domain must match the From domain.r relaxed (default) or s strict
foWhen to send failure reports.0 (default), 1, d, s
t NewTesting mode. With t=y, receivers apply one level lower than p.y or n (default)
psd NewMarks a public suffix domain. Only for registries and similar operators.y, n, u (default)
pct RemovedApplied the policy to a percentage of mail. Newer receivers ignore it.Use t=y instead
ri RemovedRequested report interval. Reports arrive about daily anyway.Remove it
rf RemovedFailure report format. Only one format was ever used.Remove it
Policies

DMARC policy: none vs quarantine vs reject

The policy is the most important tag. Move through these steps in order, using your reports to confirm that your own mail passes before each change.

  1. Step 1 · monitor

    p=none

    Failing mail is delivered as normal. You get reports. Stay here 2–4 weeks while you find every sender.

  2. Step 2 · spam folder

    p=quarantine

    Failing mail goes to spam. A safe middle step; add t=y first if you want a softer start.

  3. Step 3 · refuse

    p=reject

    Failing mail is refused. This is full protection against spoofing your exact domain.

Reports

DMARC reports: rua and ruf

Reports are how you find out who sends mail as your domain. Without them, you can’t safely enforce a policy.

Aggregate reports (rua)

  • Sent about once a day by Gmail, Yahoo, Microsoft and others, as compressed XML files.
  • They list every sending IP with SPF, DKIM and DMARC results, but no message content.
  • Use a dedicated mailbox or a DMARC reporting service. A busy domain can get hundreds a day.

Reports to another domain

  • If rua points elsewhere (for example a reporting service), that domain must agree to receive your reports.
  • It does that with a TXT record like this one, published on its own domain:
    example.com._report._dmarc.reports.example.net  "v=DMARC1"
  • This checker verifies it and warns you when the record is missing.
Requirements

DMARC requirements at Gmail, Yahoo and Microsoft

The largest mailbox providers now require DMARC from bulk senders, meaning anyone who sends about 5,000 or more messages a day to their users.

Gmail

Since February 2024, bulk senders need SPF, DKIM and a DMARC record (at least p=none), with the From domain aligned to SPF or DKIM. Google began rejecting more non-compliant mail in November 2025.

5,000+ messages a day

Yahoo

Same rules as Gmail since 2024: SPF, DKIM, DMARC with at least p=none, alignment, and one-click unsubscribe for marketing mail.

Bulk senders

Microsoft (Outlook.com)

Since May 2025, high-volume senders to Outlook.com, Hotmail and Live addresses need SPF, DKIM and DMARC of at least p=none. Non-compliant mail can be sent to junk or rejected.

5,000+ messages a day
FAQ

DMARC checker FAQ

What does a DMARC checker do?

It looks up the TXT record at _dmarc.yourdomain in public DNS, checks that it’s valid and explains what it tells receiving servers to do: the policy, which subdomains it covers, how strictly domains must match and where reports go.

Is this DMARC checker free?

Yes. There’s no account and no email signup, and you can check as many domains as you like. Only the domain name is sent to public DNS resolvers, and nothing is stored.

Why does it say no DMARC record found?

Either the domain has never published a DMARC record, the record was added at the wrong host (for example _dmarc.example.com.example.com), or it doesn’t start with v=DMARC1 exactly. New records can also take from a few minutes to a few hours to appear.

What does “DMARC policy not enabled” mean?

It means the record uses p=none. DMARC is set up and can send you reports, but receivers don’t act on mail that fails, so spoofed messages are still delivered. It’s the right first step, not the end state.

Which DMARC policy should I use?

Start with p=none and a report address. When reports show that all your legitimate mail passes SPF or DKIM with alignment, move to p=quarantine and then p=reject. Take as long as your reports need; rushing to reject can block your own mail.

Why am I not getting DMARC reports?

Check that the record has a rua tag with a mailto: address, that the mailbox accepts large attachments, and, if the address is on another domain, that the domain has published the authorization record. Reports also only arrive once you’ve actually sent mail to providers that report.

Do subdomains need their own DMARC record?

No. Subdomains without their own record use the parent domain’s record, with the sp policy if it’s set. Give a subdomain its own record only if it needs different settings.

What happened to the pct tag?

RFC 9989, the updated DMARC standard, removed pct along with ri and rf. Newer receivers ignore pct and apply the policy to all failing mail. For a gradual rollout, use t=y (testing mode) instead.

What’s the difference between DMARC, SPF and DKIM?

SPF lists the servers allowed to send for your domain. DKIM signs each message so it can be verified. DMARC ties them to the From address people see, tells receivers what to do when both fail, and sends you reports.

Atomic Mail Business

Email on your own domain, set up the right way

When you connect your domain, Atomic Mail shows you the MX, SPF, DKIM and DMARC records to add. Mail between your team is end-to-end encrypted, with no ads and no tracking.

Get business emailCreate a DMARC record