Skip to content
Emergency helpGet started
Back to Tools

DMARC Checker

Look up a domain's DMARC record and see its policy, subdomain policy, reporting address and what to fix. The same scan grades SPF, DKIM and the rest of the domain's email security.
Start a check
  • DNS-Based Scan
  • Non-Intrusive Analysis

What is a DMARC record?

A DMARC record is a DNS TXT record at _dmarc followed by your domain, starting with v=DMARC1. It tells receiving servers what to do with mail whose From domain is not backed by an aligned SPF or DKIM pass, and where to send reports. Its policy tag, p, is none (monitor only), quarantine or reject.

This DMARC checker reads the record for the domain. If there is none, it looks up the organizational domain's record, as receivers do, and says when the policy is inherited. It then runs the full Email Security scan for SPF, DKIM and the other records.

DMARC was defined in RFC 7489. In May 2026, RFC 9989 replaced it as a Standards Track specification, adding the np and t tags and making pct historic. The checker reads the RFC 7489 tags.

How the DMARC check scores the record

The record starts at 100 and loses points for each weakness. 80 or more is good, 50 to 79 is a warning and below 50 is bad. DMARC carries 25 of the 100 points in the overall email security grade, more than any other record.
p=reject
Full credit.
p=quarantine
Costs 10 points.
p=none
Costs 40 points: receivers take no action on failing mail.
pct below 100
Costs 15 points: only part of failing mail is subject to the policy.
No rua
Costs 10 points: no aggregate reports are requested.
sp=none with a stricter p
Costs 5 points: subdomains are less protected than the domain.
Inherited record
Scored from the organizational domain's sp, or p without sp: reject 100, quarantine 75 and none 50, minus 15 when pct is below 100.

Common DMARC problems and how to fix them

These are the problems this checker detects, with the change that fixes each one.

No DMARC record

Without DMARC, receivers apply their own rules to mail that fails SPF and DKIM, and you get no reports about who sends mail as your domain.

Fix: Publish a TXT record at _dmarc for the domain, starting in monitoring mode with an address for aggregate reports.

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

p=none that never moves on

p=none asks receivers to take no action, so spoofed mail is still delivered. It is a stage for collecting reports, not protection.

Fix: Use the aggregate reports to fix SPF and DKIM for every legitimate sender, then move to p=quarantine and later p=reject. For domains whose users post to mailing lists, RFC 9989 suggests at least a month at p=none and as long again at p=quarantine before p=reject.

No rua reporting address

Without rua, receivers send no aggregate reports (RFC 7489, section 6.3), so you cannot see which services fail before you enforce a policy.

Fix: Add rua=mailto: with a mailbox you read or a DMARC reporting service's address. A mailbox at another organizational domain has to authorize your domain first (RFC 7489, section 7.1).

pct below 100

pct applies the policy to only part of failing mail. RFC 9989 made pct historic because receivers applied values other than 0 and 100 inconsistently.

Fix: Remove pct, so the policy applies to all failing mail, or use t=y while you test a stricter policy.

Weaker subdomain policy

sp=none with p=quarantine or p=reject leaves subdomains open to spoofing, including subdomains you never use for mail.

Fix: Remove sp so subdomains follow p, or set it to the same level.

DMARC tags

Tags are separated by semicolons. Tags a receiver does not know are ignored.
v=DMARC1
The version. It must be the first tag.
p=
The policy for mail that fails DMARC: none, quarantine or reject.
sp=
The policy for subdomains. Without it, subdomains follow p.
rua=
Where aggregate reports go, as mailto: addresses separated by commas.
ruf=
Where failure reports about individual messages go. Many large mailbox providers do not send them.
adkim= / aspf=
DKIM and SPF alignment: r (relaxed, the default) accepts a subdomain of the From domain, s (strict) needs an exact match.
fo=
Which failures trigger failure reports: 0, 1, d or s. Ignored without ruf.
pct=
The percentage of failing mail the policy applies to, 100 by default. RFC 9989 made it historic.
np= / t=
Added by RFC 9989: a policy for subdomains that do not exist, and t=y to test a policy without applying it in full.

Example record

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Sources

More email authentication tools

Beyond DNS records

These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.

Managed SOCGet started
Questions

DMARC checker FAQ

What does a DMARC checker do?

It looks up the TXT record at _dmarc followed by the domain and checks the policy, subdomain policy, pct and aggregate report address. This one also follows the organizational domain fallback that receivers use and runs the full email security scan.Email Security AnalyzerCompare the public security checks

What is a DMARC lookup?

A DNS TXT query for _dmarc followed by the domain, for example _dmarc.example.com. If nothing is published there, receivers use the organizational domain's record. You can run one on this page, or with dig TXT _dmarc.example.com.About email authentication

What is the difference between p=none, p=quarantine and p=reject?

none asks receivers to take no action and only report, quarantine asks them to treat failing mail as suspicious, for example by delivering it to spam, and reject asks them to reject it. Receivers combine the policy with their own checks when they decide.About email authentication

Why does the checker say my DMARC record is inherited?

The domain has no DMARC record of its own, so receivers apply the organizational domain's record, using its sp policy, or p when there is no sp (RFC 7489, section 6.6.3). Publish a record at the subdomain if it needs a different policy.About email authentication

Should I use p=reject?

Only once your reports show every legitimate sender passing. RFC 9989 requires domains that publish p=reject to sign their mail with DKIM rather than rely on SPF alone, and advises domains whose users post to mailing lists not to publish p=reject (section 7.4).About email authenticationEmail Security Analyzer

Is RFC 7489 still the DMARC standard?

No. RFC 9989, published in May 2026 on the Standards Track, obsoletes RFC 7489. It keeps v, p, sp, rua, ruf, adkim, aspf and fo, adds np, psd and t, and makes pct, rf and ri historic. Aggregate and failure reporting moved to RFC 9990 and RFC 9991.About email authentication

Can DMARC reports go to another domain?

Yes, but unless the report address shares your organizational domain, the receiving domain must publish a TXT record containing v=DMARC1 at your domain, then _report._dmarc, then its own domain, for example example.com._report._dmarc.example.net. Without it, receivers cannot confirm the arrangement and do not send reports there (RFC 7489, section 7.1; RFC 9990, section 4).About email authentication

Can I run a DMARC lookup through an API?

Yes. POST {"target":"example.com"} to https://vigilbase.com/api/v1/agent/tools/email-security/execute. The response holds the full email security result, with the DMARC analysis under result.details.records.dmarc.Run a check through the public APIAPI authentication and rate limits