DMARC
Enter a domain above to run this check.
DMARC
CHECK.
Read the DMARC of the domain: the p=, sp= and pct= policy, the rua reports and alignment, and the safe path from p=none to p=reject.
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
WAITING
What the check verifies
Reads the DMARC policy: what receivers should do with messages that fail SPF and DKIM, and where to send the reports.
Why it matters
With p=none the domain only monitors: spoofed email still arrives. It is p=quarantine or p=reject that blocks spoofing.
What each result means
- OK
- p=quarantine or p=reject, applied to 100% of the messages.
- WARNING
- p=none (monitoring only), pct below 100, or no DMARC on a domain that does not use email.
- FAIL
- No DMARC on a domain that sends or receives email, more than one record, or a record without a valid p=.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
Publish it at _dmarc.<domain>. Start with p=none and reports, make sure legitimate mail passes aligned SPF or DKIM, then tighten to quarantine and later reject:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"Would rather have someone else do it? Bit Happens can fix this →
More checks in Email
Generate a record in Email Health →
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →