Start free
ProductHow it worksPlatform tourSafety and controlsYour first 30 daysCompetitor trackingLinkedIn signalsDone for youHubSpotSalesforceSmartleadAll integrationsFounder-led salesBefore the first SDRAccount-based marketingClosed-lost reactivation
Free toolsFree ICP assessmentSandbox workspaceSPF, DKIM and DMARC checkOutbound cost calculatorB2B outbound glossaryRoast my cold emailOutlevo CommunityICP generatorCold email generatorSubject line graderEmail word checkerBlacklist checkUse it from Claude, Cursor, LovableDeveloper hubAPI reference
IntegrationsFor AI buildersPricingResources
Theme
Log inStart free

Free · no sign-up

DMARC record checker

Enter a domain. We read its DMARC record live, explain every tag in it, and say whether the record protects the domain or only watches it.

What a DMARC record is

DMARC tells receivers what to do when a message claiming to be from your domain fails authentication, and where to send reports about it. A message passes when SPF or DKIM passes and the domain that passed matches the visible From domain: that match is called alignment.

RFC 9989, the current DMARC standard, puts the record in a TXT record at _dmarc followed by your domain name. Sending tools that sign with their own domain can pass DKIM and still fail DMARC, which is what the reports are for.

TagWhat it does
p=none | quarantine | rejectThe policy. none only monitors; quarantine asks receivers to treat failures as suspicious; reject asks them to refuse failures.
sp=A separate policy for subdomains. Without it, the p policy covers them too.
rua=mailto:…Where aggregate reports go: daily summaries of who sent mail as your domain and whether it passed. Without it you are blind.
adkim=, aspf=Alignment strictness, r (relaxed) or s (strict). Relaxed lets a subdomain match its parent.
pct=An older tag for the share of mail the policy applies to. It is gone from the current standard, so treat it as a leftover.

In RFC 9989, adkim and aspf default to relaxed, a record without p is treated as p=none, and the pct tag is removed.

Common errors and how to fix them

  • No DMARC record
    Without one, receivers have no instruction and you receive no reports. Mailbox providers also ask for it from bulk senders (see the question below).
    Fix: Publish a TXT record at _dmarc.yourdomain such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.
  • Record at the wrong name
    The record must sit at _dmarc.yourdomain. One at the root of the domain, or at dmarc.yourdomain, is ignored.
    Fix: Move it to the _dmarc host.
  • Stuck on p=none
    It is the right place to start, but it protects nothing: spoofed mail is still delivered.
    Fix: Read the reports for a few weeks, fix every legitimate sender that fails, then move to p=quarantine and later p=reject.
  • Jumping straight to p=reject
    A legitimate tool that is not aligned (it signs with its own domain, or sends from an IP not in SPF) will have its mail refused.
    Fix: Go through none and quarantine first, with reports on.
  • No rua address
    You cannot see who is sending as you, so you cannot tell when it is safe to tighten the policy.
    Fix: Add rua=mailto:… to a mailbox or a DMARC report service you read.
  • Two DMARC records, or a typo in a tag
    Receivers may ignore a domain with two records, and a misspelled tag (quarentine) is not a valid policy.
    Fix: Keep one record and compare each value with the tags above.

Examples

Illustrative records. Replace the report address with one you read.

Step 1: watch

v=DMARC1; p=none; rua=mailto:[email protected]

Step 2: quarantine failures, a softer policy for subdomains

v=DMARC1; p=quarantine; sp=none; rua=mailto:[email protected]

Step 3: reject

v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s

Questions

Do I need DMARC to send cold email?
Gmail and Yahoo require SPF or DKIM for all senders, and SPF, DKIM and DMARC for bulk senders. Even below the bulk threshold, a published DMARC record is cheap protection for a domain you send from.
What policy should I have?
Start at p=none with reports on, so you learn who sends as you. Move to quarantine and then reject when the reports show only senders you recognise.
What is alignment?
The domain that passed SPF or DKIM has to match the domain in the visible From address. Relaxed alignment accepts a subdomain of it; strict requires an exact match.
Is the pct tag still used?
In RFC 9989, adkim and aspf default to relaxed, a record without p is treated as p=none, and the pct tag is removed. Receivers may still honour it on older records, so we show it if it is there.
Does DMARC apply to subdomains?
Yes. Unless sp says otherwise, the policy in p covers every subdomain, so check the ones you send from.

The other checks

SPF

Which servers may send as your domain.

DKIM

The signature that proves a message was not changed.

MX

Where replies to your domain are delivered.

All four at once

The full SPF, DKIM, DMARC and MX check.

Blocklist

Is a sending address on a public blocklist?

Outlevo checks this before every campaign

Outlevo checks SPF, DKIM and DMARC on a sender before it sends.

Start in the sandboxFind my buyers, free →