Free, reads live DNS
DMARC record checker
Read your DMARC policy and alignment, and see exactly what to publish to move from monitoring (p=none) to enforcement.
No DMARC record found for
Start with a monitoring policy to collect reports, then tighten it:
DMARC for
Your policy is p=none — it monitors but blocks nothing.
Once your aggregate reports look clean, move to p=quarantine, then p=reject, to stop spoofing.
Good — your domain is enforced at . Keep an eye on reports so legitimate mail isn't caught.
Direct answer
What is a DMARC record?
A DMARC record is a DNS TXT record at _dmarc.yourdomain.com. It tells receivers what to do when SPF or DKIM fails for mail that claims to be from your domain, and where to send reports. The policy tag p= is none, quarantine, or reject. Alignment means the domain in the visible From address matches the domain that passed SPF or DKIM.
- A record with no p= tag is invalid. Receivers ignore it.
- p=none still delivers mail. It only asks receivers to send reports.
- rua= is the address that receives aggregate XML reports, usually once a day. ruf= asks for a copy of individual failures, and many receivers do not send those.
- Gmail and Yahoo require a DMARC record from bulk senders. p=none meets that requirement. It does not stop spoofing.
Questions people ask
Should I start with p=none or p=reject?
Start with p=none and a rua address. Read the reports for at least a few weeks. Move to quarantine, then reject, only after your own mail passes SPF or DKIM and aligns. Reject on day one will bounce mail from any sender you forgot, including a billing tool or a CRM.
What is DMARC alignment?
SPF can pass and still fail DMARC if the envelope domain and the From domain do not match. DKIM can pass on a vendor domain and still fail DMARC for the same reason. Alignment is the match. Relaxed alignment (the default) allows a subdomain. Strict alignment requires an exact domain match.
Where does the DMARC record go?
Publish a single TXT record on the host _dmarc, for example _dmarc.example.com. It does not go on the root next to SPF, and it is not a CNAME.
What does a DMARC checker look at?
It reads the live _dmarc TXT record, the policy, the alignment mode, and the report addresses. It does not read the XML reports themselves. Use the DMARC report analyzer for a file you already received.
The records are only half of inbox placement.
Once SPF, DKIM, and DMARC pass, a cold domain still needs a slow sending history. iSend warms the domain and sends with the same authentication these tools just checked.