Guide
DMARC check: reading a DMARC record tag by tag
DMARC tells receiving mail servers what to do with messages that claim to come from your domain but fail SPF and DKIM. A wrong record means spoofed mail gets through, or your own mail lands in spam. Here is how to check it.
Where the DMARC record lives
DMARC is a TXT record at _dmarc. in front of your domain. For example.com, look up the TXT record of _dmarc.example.com:
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"There must be exactly one such record. Two DMARC records make receivers ignore both.
The tags that matter
| Tag | Meaning | Example |
|---|---|---|
v | Version. Must be first and must be DMARC1. | v=DMARC1 |
p | Policy for the domain: none (only report), quarantine (treat as suspicious, usually spam folder) or reject (refuse the message). | p=reject |
sp | Policy for subdomains. Defaults to p. | sp=quarantine |
pct | Share of failing messages the policy applies to, 0–100. Defaults to 100. | pct=25 |
rua | Where aggregate reports are sent. | rua=mailto:dmarc@example.com |
ruf | Where failure reports are sent. Many providers don’t send them. | ruf=mailto:forensic@example.com |
adkim, aspf | Alignment mode for DKIM and SPF: r relaxed (subdomains match, default) or s strict. | adkim=s |
p=none, quarantine or reject?
- p=none protects nothing; receivers only send reports. Use it for a few weeks to see who sends mail as your domain.
- p=quarantine sends failing mail to spam. A safe step once all your services pass.
- p=reject blocks spoofed mail completely. The goal for most domains.
A record with p=none and no rua gives you neither protection nor reports, so it does nothing at all.
How DMARC decides: alignment
A message passes DMARC when SPF or DKIM passes and the domain it checked matches the domain in the From header. SPF checks the envelope sender (Return-Path); DKIM checks the d= domain in the signature. A newsletter service that signs with its own domain passes DKIM but fails DMARC alignment until you set up DKIM for your domain with that service.
Common mistakes
- The record is at the domain itself instead of at
_dmarc. - Two DMARC records, or a DMARC record in an SPF record.
pctleft below 100 after testing, so most spoofed mail is still delivered.- Moving to
p=rejectbefore every sending service (CRM, helpdesk, newsletters) passes SPF or DKIM with alignment. - Reports sent to an address at another domain without that domain’s permission record.
Check SPF and DKIM too
DMARC depends on the other two. An SPF record must stay within 10 DNS lookups, including nested includes, or it fails with a permanent error. DKIM keys sit under a selector name (for example google._domainkey) that DNS cannot list, so you need to know the selector your provider uses.