Free tool · Check
DMARC record checker
Look up a domain's DMARC record and see what each tag means for your mail, with a fix for anything that's missing or wrong.
Fix this by sending through Groundmail
Add your domain and we give you the exact SPF, DKIM, DMARC and return-path records, check them for you, and sign every message with your own domain's key. Free for 3,000 emails a month.
What DMARC does
DMARC tells receivers what to do with mail that claims to be from your domain but fails authentication, and where to send reports. A message passes DMARC when SPF or DKIM passes for a domain that matches the From address.
Start at p=none with a rua address to collect reports, check that your own mail passes, then move to quarantine and reject to stop spoofing.
Go deeper: Google, Yahoo and Microsoft sender rules
Questions
Do I need a DMARC record?
Yes, if you send more than a trickle of mail. Google and Yahoo require a DMARC record (at least p=none) from bulk senders, and Microsoft does too for high-volume senders to Outlook.com.
What's the difference between p=none, quarantine and reject?
none only monitors. quarantine asks receivers to put failing mail in spam. reject asks them to refuse it. Move up only once reports show your legitimate mail passes.
What are rua and ruf?
rua is where receivers send daily aggregate reports (counts by sending IP and result). ruf is for per-message failure reports, which few receivers send. Point rua at a mailbox or a DMARC report service.
What does DMARC alignment mean?
The domain that passed SPF (the return path) or DKIM (the d= tag) must match your From domain. Relaxed alignment, the default, lets subdomains match; strict needs an exact match.