Look up the DMARC record of any domain. See its policy and every tag explained in plain words, find problems, and learn how to protect your domain from spoofing.
Every check reads the domain's public DNS records for MX, SPF and DMARC. DKIM needs a selector from a real email, so check it with the email header analyzer.
DMARC is a TXT record published at _dmarc.yourdomain that protects the From address people see. It tells receiving servers what to do when an email claims to be from your domain but fails SPF and DKIM, and where to send reports about it. A typical record looks like v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com.
Monitor only. Failing emails are still delivered, but you get reports. Use it while you set things up.
Failing emails go to the spam or junk folder. A good step before full blocking.
Failing emails are blocked. This is the strongest protection against people faking your domain.
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain to start receiving reports.| Goal | Example record |
|---|---|
| Start monitoring | v=DMARC1; p=none; rua=mailto:dmarc@example.com |
| Send failing email to spam | v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com |
| Block failing email | v=DMARC1; p=reject; rua=mailto:dmarc@example.com |
| Block, but only watch subdomains | v=DMARC1; p=reject; sp=none; rua=mailto:dmarc@example.com |
Replace example.com with your own domain. The record goes in a TXT record named _dmarc at your DNS host.
DMARC does not just ask "did SPF or DKIM pass?" It asks "did they pass for the same domain people see in the From address?" That match is called alignment.
Here is a common example. A shop sends invoices through an email service. The From address is billing@shop.com, but the hidden return address belongs to the service. SPF passes for the service's domain, not for shop.com, so SPF is not aligned. If the service signs the email with DKIM for shop.com, DKIM is aligned and DMARC passes. Without that DKIM signature, DMARC fails, even though SPF technically passed.
This is why setting up DKIM with your own domain at every email service is the most important step before a strict DMARC policy.
When your record has a rua address, inbox providers send it a daily aggregate report. Each report is an XML file that lists the IP addresses that sent email using your domain, how many messages each sent, and whether they passed SPF, DKIM and DMARC.
The files are hard to read by hand, so most people send them to a free or paid DMARC report service that turns them into charts. What you are looking for is simple: every real service you use should pass. Anything that fails is either a service you forgot to set up or someone faking your domain.
Google's email sender guidelines require DMARC for anyone sending more than 5,000 emails a day to Gmail accounts, with SPF or DKIM aligned to the From domain.
Since 2024, Gmail and Yahoo require bulk senders to publish a DMARC record along with SPF and DKIM. Check your SPF record and MX records too.