Skip to content
inboxprobe

Checkers

Generators

Guides

Checkers

DMARC record checker

Reads your DMARC record tag by tag, explains what the policy actually does to spoofed mail, and gives you the next record in a safe rollout.

What DMARC adds on top of SPF and DKIM

SPF and DKIM each prove something about a domain — but not necessarily the domain in the From address people see. DMARC closes that gap: a message passes DMARC only if SPF or DKIM passes for a domain aligned with the From address. Your DMARC record then tells receivers what to do with mail that fails, and where to send reports.

A typical record after the monitoring phase

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=quarantine; rua=mailto:[email protected]

Every tag, explained

TagValuesMeaning
vDMARC1Required, must come first.
pnone · quarantine · rejectPolicy for the domain. Required.
spsamePolicy for subdomains without their own record. Defaults to p.
npsameRFC 9989: policy for subdomains that don't exist at all.
ruamailto: addressesWhere daily aggregate (XML) reports go. Strongly recommended.
rufmailto: addressesPer-message failure reports. Few providers send them.
adkim / aspfr (relaxed) · s (strict)Whether subdomains count as aligned. Default r.
pct0–100RFC 7489 rollout percentage. Removed in RFC 9989.
ty · nRFC 9989 testing flag: apply one level lighter than p.
fo0 1 d sWhen to send failure reports.

DMARC was updated in May 2026: RFC 9989 replaces RFC 7489. pct, rf and ri are gone, t, np and psd are new, and a DNS "tree walk" replaces the Public Suffix List for finding the organisational domain. Old records keep working; we understand both.

The p=none trap

p=none satisfies the Gmail, Yahoo and Outlook bulk-sender rule — but it protects nothing: spoofed mail is still delivered. It exists so you can collect reports first. Many domains publish it during setup and never come back. If your record has said p=none for months, read your reports, fix any sender that fails, and move on to quarantine.

  1. Monitor — p=none with rua=. 2–4 weeks, until every legitimate source passes.
  2. Quarantine — p=quarantine. Failing mail goes to spam. A few weeks of clean reports.
  3. Reject — p=reject. Spoofed mail is refused. Required for BIMI logos.

The DMARC record generator walks you through each stage.

Alignment, with an example

You send a newsletter with From: [email protected] through a mailing service. SPF passes for bounces.mailservice.net (the service's return path) — not aligned. DKIM passes with d=example.com because you set up the service's DKIM CNAMEs — aligned. Result: DMARC passes. Without your own DKIM in that service, DMARC would fail even though "SPF passed".

Relaxed alignment (the default) accepts any domain under the same organisational domain: mail.example.com aligns with example.com. Strict (adkim=s, aspf=s) requires an exact match. Gmail and Yahoo accept relaxed.

Reports to another domain need permission

If rua= points to a different domain (a report service, or your agency), that domain must publish a TXT record at yourdomain._report._dmarc.theirdomain containing v=DMARC1. Otherwise receivers silently drop your reports. We check this for every external address.

Questions

Is p=none enough for Gmail and Yahoo?

Yes, for the requirement itself: both accept any valid DMARC policy including p=none, as long as SPF or DKIM aligns with your From domain. But p=none doesn't stop anyone spoofing your domain, so treat it as a first step and plan to tighten it.

How long should I stay at p=none?

Long enough to see every legitimate sender in your aggregate reports and fix the ones that fail alignment — typically 2 to 4 weeks, longer if you have many sending services. There's no benefit to staying there once reports are clean.

What's the difference between p and sp?

p applies to the domain itself. sp applies to subdomains that don't publish their own DMARC record. If sp is absent, subdomains get p. sp=none with p=reject leaves every subdomain open to spoofing.

Do I still need pct?

No. pct was removed in RFC 9989 (May 2026) and replaced by the t=y testing flag. Receivers that still follow the old spec may honour pct; newer ones may ignore it. Short, well-monitored stages work with both.

Where should DMARC reports go?

To a mailbox you don't read by hand, or a DMARC report service that turns the daily XML files into charts. Expect from a few to hundreds of emails a day depending on volume.

Sources

Last reviewed: