DMARC Record Checker

Where does the tool look for the DMARC record?

It queries the TXT records at _dmarc.<your domain> through Cloudflare’s DNS-over-HTTPS service and takes the first one starting v=DMARC1. If a subdomain has no record of its own, it walks up to the parent domains, as receivers do, and the Found at line shows where the record was published. For an inherited record the policy shown is the sp= value when present, otherwise p=. The walk stops at two labels and does not use the public suffix list, so for a name like example.co.uk it may also query _dmarc.co.uk, which is harmless.

What do p=none, p=quarantine and p=reject do?

They tell receivers what to do with mail that fails DMARC: none means take no action but still send reports, quarantine means treat it as suspicious (typically the spam folder), and reject means refuse it during delivery. The tool marks reject as good and the other two as warnings. Starting at none and moving up once reports show all your legitimate mail passes is the usual rollout.

What does a message have to do to pass DMARC?

Either SPF or DKIM must pass, and the passing domain must align with the domain in the visible From header. Under relaxed alignment a shared organisational domain is enough (mail.example.com aligns with example.com), while strict alignment requires an exact match. The tool shows adkim and aspf only if they are present in the record; when absent, the defaults are relaxed.

What are rua and ruf, and why does the tool warn when rua is missing?

rua is the address (written mailto:) that receives aggregate XML reports summarising which sources sent mail as your domain and whether it passed. ruf requests per-message failure reports, which many receivers do not send. Without rua you cannot see who is sending as your domain, so the tool flags it as Not configured. The tool does not check that the report address works or accepts reports.

What does pct mean?

pct sets the percentage of failing messages the policy applies to, with the remainder getting the next lower policy. With p=quarantine and pct=25, a quarter of failing mail is quarantined. The tool prints it as Apply to, and 100% (default) when the tag is absent. It is a rollout aid and is normally removed once a policy is stable.

What does it not validate?

It does not check syntax rules such as v=DMARC1 being the first tag, does not verify report destinations, does not read the fo, ri or rf tags, and does not test whether your mail actually passes. If more than one DMARC record is published it flags this, because receivers ignore DMARC in that case. Pair it with the SPF and DKIM checkers and with real aggregate reports.

Does p=reject stop all spoofing of my domain?

It stops messages that claim to be from your exact domain and fail DMARC at receivers that honour it. It does not stop look-alike domains such as examp1e.com, and it does not stop spoofing of subdomains unless sp covers them or the subdomains inherit the policy.