The record is there
We look for a TXT record at _dmarc.domain, and for a subdomain without one, on the parent domain. There must be one record with the required p= tag.
DMARC record checker
DMARC sets a policy for messages whose From domain cannot be authenticated: monitor them, request spam placement or request rejection. We check the DNS record, the selected policy and the report address.
Check DMARC by domain name
If a subdomain has no record of its own, we show the one that applies from the parent domain.
What we check in DMARC
The policy
p=none lets you collect reports without requesting blocking. p=quarantine asks recipients to send messages that fail DMARC to spam; p=reject asks them to reject those messages. The receiving server makes the final decision.
Reports
The rua= tag sets the address where Gmail, Microsoft and others send daily summaries. They show who sends mail as your domain.
DMARC questions
Which policy to start with, what the reports contain and how subdomains work.
Which DMARC policy should I start with?
Start with p=none and an aggregate report address in rua=. Collect reports over a normal business cycle, including newsletters and occasional notifications. Confirm that all your mail sources pass DMARC: either SPF or DKIM must pass and align with the From domain. You can then move to p=quarantine and later p=reject. Enforcing a strict policy immediately may block mail from a forgotten CRM or newsletter service.
What is in DMARC reports?
Once a day large mailbox providers send an archive with XML to the rua= address: which IP addresses sent mail as your domain, how many messages and whether they passed SPF and DKIM. Message content isn’t included. XML is awkward to read by hand, so reports usually go to an analysis service, and many are free for small volumes.
How does DMARC work for subdomains?
If a subdomain has no _dmarc record of its own, the recipient uses the parent domain’s record. Its sp= tag sets a separate policy for subdomains: p=quarantine; sp=reject, for instance, is stricter with subdomains you never send from. A subdomain’s own record overrides the parent’s.
More tools: Domain email
Email settings checker
MX, SPF, DKIM, DMARC and blacklists in one go, scored out of nine.
OpenSPF checker
Check an SPF record for errors, the DNS lookup limit and sender rules.
OpenDKIM checker
Find a DKIM key in DNS and check its length and status.
OpenMX lookup
The domain’s mail servers, their addresses, reverse DNS and encryption.
OpenBlacklist check
Check an IPv4 address or a domain’s mail server IPs against blacklists.
OpenSPF generator
Choose your mail senders to create an SPF record for DNS.
OpenDMARC generator
Choose how to handle messages and where to send DMARC reports.
OpenEmail on your own domain comes with hosting
On our hosting, mailboxes on your domain are part of the plan, and mail records are set up in the Plesk panel.
Keep domain records on reliable DNS
Host MX, SPF, DKIM and DMARC on our name servers: you edit records yourself at any time, the domain can stay with any registrar and mail with any provider.