Look up and validate the DMARC TXT record published at _dmarc.<domain>, then read your policy, alignment, and reporting tags in plain terms. It is free, instant, and runs entirely in your browser with no signup and no data stored.
Create a free Unspam account to re-run these checks on a schedule and get alerted the moment your setup breaks. No credit card.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record published in DNS at _dmarc.yourdomain.com. It tells receiving mail servers what to do when a message that claims to be from your domain fails SPF and DKIM alignment, and where to send reports about those checks. DMARC builds on SPF and DKIM: a message passes DMARC when at least one of them passes and the authenticated domain aligns with the domain in the visible From header. Without DMARC, attackers can spoof your exact domain in the From address, and you have no visibility into who is sending mail in your name. Since February 2024, Google and Yahoo require bulk senders to publish a DMARC record, so a valid record is now part of basic deliverability, not just security.
The version tag. It must be exactly v=DMARC1 and must come first, or receivers ignore the record entirely. This is what marks the TXT record as a DMARC policy rather than an unrelated string.
The enforcement policy for your main domain. p=none only monitors and collects reports, p=quarantine sends failing mail to spam, and p=reject blocks it outright. Google and Yahoo require at least p=none for bulk senders, but reject gives the strongest spoofing protection.
sp= sets a separate policy for subdomains (it inherits p= if absent), and pct= applies the policy to only a percentage of mail for a staged rollout. Note that pct was removed in the latest DMARC specification (RFC 9989, published 2026), which replaces it with a simpler t flag for test mode, so newer guidance favors moving straight to full enforcement.
rua= is the mailbox (for example mailto:dmarc@yourdomain.com) that receives daily aggregate reports showing every source sending as your domain. ruf= receives per-message failure reports. Aggregate reports are how you safely move from p=none toward enforcement.
These set alignment strictness for SPF and DKIM. The default value r (relaxed) allows subdomains of your organizational domain to align, while s (strict) requires an exact match. Relaxed is the right default for most senders that use subdomains or third-party services.
The lookup returns nothing at _dmarc.yourdomain.com, so receivers apply no policy and your domain can be freely spoofed. Publish a TXT record at that host starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com to begin monitoring without risk to delivery.
p=none only monitors and never blocks spoofed mail, yet many domains leave it there for years. Use the aggregate reports from your rua= address to confirm your legitimate senders pass, then move to p=quarantine and eventually p=reject for real protection.
Without a rua= reporting mailbox you are blind to who is sending as your domain, which makes enforcement unsafe. Add rua=mailto: pointing to an inbox or DMARC report processor you actually read before tightening the policy.
Publishing two TXT records at _dmarc, or putting v= anywhere but first, makes the record invalid and receivers ignore it. Keep exactly one record, start it with v=DMARC1, and separate every tag with a semicolon.
SPF or DKIM can pass while the authenticated domain does not match your From domain, so DMARC still fails. Confirm SPF uses your own Return-Path domain or that DKIM signs with a d= that matches your From domain, and check aspf/adkim if you rely on subdomains.
