DMARC Record Checker
Enter a domain to look up its DMARC record at _dmarc.<domain> and read what it actually enforces: the policy (none, quarantine, or reject), the subdomain policy, the percentage, SPF/DKIM alignment modes, and where aggregate reports go. DMARC ties SPF and DKIM to the visible From address and is what stops exact-domain spoofing.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Whether a DMARC (v=DMARC1) record exists
- The enforcement policy p= (none / quarantine / reject)
- The subdomain policy sp=
- The percentage pct=
- SPF/DKIM alignment modes (strict vs relaxed)
- The aggregate report address (rua)
How to read the result
- OK = an enforcing policy (p=quarantine or p=reject) — spoofed mail is blocked or junked.
- Warn (p=none) = monitor-only; it reports but doesn't protect yet — move to enforcement once reports look clean.
- Fail (no record) = no anti-spoofing policy at all; publish DMARC.
- Relaxed alignment is the default; strict (adkim=s, aspf=s) is tighter.
Frequently asked questions
What does p=none / quarantine / reject mean?
p=none only monitors (no enforcement); p=quarantine sends failing mail to spam; p=reject blocks it outright. reject is the strongest anti-spoofing stance.
Why start at p=none?
p=none lets you collect aggregate (rua) reports and confirm all your legitimate mail aligns before enforcing, so you don't accidentally block your own mail.
What is alignment?
DMARC passes only if SPF or DKIM passes AND the authenticated domain aligns with the visible From domain. adkim/aspf control whether alignment is strict (exact) or relaxed (organizational domain).
Do I need DMARC for BIMI?
Yes — BIMI (your brand logo in inboxes) requires an enforced DMARC policy (quarantine or reject).