DMARC Record Checker

Query the public TXT record at _dmarc.your-domain through Google DNS-over-HTTPS and inspect the published DMARC policy. The checker displays the p policy, optional sp subdomain policy, pct percentage, aggregate-report address (rua), forensic-report address (ruf), raw record, validation issues, and policy advisories. It distinguishes a missing record or required p tag from valid monitoring (p=none), quarantine, and reject policies. This is a static DNS configuration review, not a test of real message alignment, report delivery, or every DMARC requirement.

How to Use the DMARC Record Checker

Inspect the public DMARC TXT record for a domain and review its policy, scope, reporting destinations, issues, and advisories.

  1. Enter the organizational domain whose email policy you want to inspect.
  2. Select Run; the checker queries the TXT record at _dmarc.domain through Google DNS-over-HTTPS.
  3. Review Policy (p), Subdomain (sp), Percent (pct), and whether a valid DMARC record was found.
  4. Read the raw record and configured rua or ruf destinations, then address validation issues separately from policy advisories.
  5. Use real message authentication results and DMARC reports before changing enforcement in production.

Interpreting the policy

  • p=none is valid monitoring, not enforcement; p=quarantine and p=reject request progressively stronger receiver action.
  • sp applies to subdomains when present, while pct controls what percentage of messages receives the requested policy.
  • rua and ruf are reporting destinations, but receiver support and actual report delivery are outside this check.

A safe rollout example

A domain may begin with p=none and a controlled rua mailbox to observe legitimate senders. After correcting SPF and DKIM alignment, the owner can deliberately move toward quarantine or reject; this tool does not decide when that change is safe.

Common mistakes

  • Publishing the value at the domain apex instead of _dmarc.domain.
  • Treating p=none as syntactically invalid rather than a monitoring policy.
  • Moving directly to reject without inventorying legitimate senders and checking alignment reports.

Limitations and privacy

This parser checks the public record and selected tags; it does not test real SPF/DKIM alignment, validate report destinations, process reports, or certify complete standards compliance.

The domain is queried through Google DNS-over-HTTPS. Public policy data is retrieved, but DMARC reports and email content are not sent to the tool.

FAQ

Where should a DMARC record be published?

For example.com, DMARC is published as a TXT record at _dmarc.example.com. The checker constructs that hostname automatically from the domain you enter.

What do p=none, quarantine, and reject mean?

p=none requests monitoring only, quarantine asks receivers to treat failing mail as suspicious, and reject requests the strongest enforcement against messages that fail aligned authentication.

Is p=none an invalid DMARC policy?

No. The checker treats p=none as valid monitoring and shows an advisory because it does not request enforcement. Organizations often use it while reviewing reports before tightening policy.

What is the sp tag?

sp specifies the requested policy for subdomains. If it is absent, DMARC handling falls back according to the parent record's policy rules.

What does pct control?

pct is the percentage of messages to which the requested policy applies. When the tag is absent, the interface displays the default value of 100.

What are rua and ruf?

rua lists aggregate-report destinations and ruf lists forensic or failure-report destinations. Receiver support and privacy policies vary, so reports are not guaranteed.

Does this checker test SPF or DKIM alignment?

No. It reads and parses the DMARC DNS record only. Whether real mail passes aligned SPF or DKIM must be checked from message authentication results and reports.

Why does a new DMARC policy still look old?

Google DNS-over-HTTPS may have the previous TXT answer cached until its TTL expires. Confirm the authoritative record and retry after the prior TTL window.

Does a p=reject result guarantee spoofed mail is blocked?

No. DMARC is applied by receiving systems, and behavior, forwarding, alignment, and local policy can vary. The result only confirms the public record parsed by this checker.

Is DMARC report data sent to this tool?

No. The tool retrieves public DNS data and displays configured report addresses; it does not receive, open, or analyze your aggregate or forensic reports.