Free DMARC Record Checker

Verify your DMARC policy, alignment, and reporting configuration instantly.

Analyze a DMARC Aggregate Report

Upload a DMARC XML report (.xml, .gz, or .zip) to visualize authentication results.

📄

Drop your DMARC report here or click to browse

.xml, .xml.gz, .zip, max 5 MB

Analyzing report…

What is DMARC and why does it matter?

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM checks fail. It can instruct servers to monitor, quarantine, or reject unauthenticated emails.

DMARC is now required by Google, Yahoo, and Microsoft for bulk senders. A proper DMARC policy protects your domain from phishing attacks and dramatically improves deliverability.

🚫

Anti-phishing

DMARC prevents attackers from sending emails that appear to come from your domain.

📊

Visibility

Aggregate reports (rua) show you exactly who sends email on behalf of your domain.

🎯

Deliverability

Domains with DMARC reject/quarantine policies see significantly better inbox placement.

Frequently Asked Questions

DMARC is an email authentication protocol that builds on SPF and DKIM. It tells receiving servers what to do when authentication fails: none (monitor), quarantine, or reject.
Start with p=none to monitor without affecting delivery. Once all legitimate sources pass SPF/DKIM, move to p=quarantine, then p=reject for maximum protection.
The rua tag specifies where receiving servers send XML reports about authentication results. These reports help you understand who sends email on behalf of your domain.
DMARC checks that the From header domain aligns with the domain authenticated by SPF or DKIM. Alignment can be strict (exact match) or relaxed (organizational domain match).
Since February 2024, Google and Yahoo require DMARC for senders of 5,000+ messages/day. Microsoft followed suit. Without DMARC, bulk emails are more likely to be rejected.
The sp tag defines the DMARC policy for subdomains (e.g. mail.example.com). If absent, subdomains inherit the parent domain's p= policy. Set sp=reject to prevent subdomain spoofing even if your main policy is more relaxed.
rua receives aggregate reports, daily XML summaries of authentication results per sending source. ruf receives forensic (failure) reports, individual message details when authentication fails. Most providers only support rua; ruf adoption is limited due to privacy concerns.
The pct tag controls what percentage of failing messages the policy applies to. pct=100 (default) applies to all. During rollout, you can use pct=10 to apply quarantine/reject to only 10% of failures while monitoring the rest.
Technically yes, DMARC only requires one of SPF or DKIM to pass with alignment. However, best practice is to deploy both. SPF alone breaks on forwarding; DKIM alone doesn't cover envelope sender. Together they provide robust authentication.
Publish a DMARC record with p=reject on each unused subdomain, or use sp=reject on the parent domain. Also add empty SPF records (v=spf1 -all) and consider a wildcard _dmarc record for comprehensive coverage.

Go beyond DMARC

DMARC works with SPF and DKIM. Run a full audit to check all your email authentication, TLS, blocklists, and more.

Run free full audit

Other free tools

SPF Checker DKIM Checker BIMI Checker Blocklist Checker Header Analyzer