Back to DMARC

Free DMARC Record Checker

Check your domain's DMARC, SPF, DKIM, DNSSEC, MTA-STS, and TLS-RPT configuration instantly.

What is DMARC?

DMARC protects your domain from email spoofing by verifying that messages pass SPF and DKIM authentication.

Instant Results

Get a complete analysis of your email security configuration in seconds. No signup required.

Actionable Advice

Get specific recommendations to fix issues and improve your email deliverability.

What a valid DMARC record looks like

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. A typical monitoring record looks like this:

v=DMARC1; p=none; np=none; rua=mailto:[email protected]; adkim=s; aspf=s
v=DMARC1

The version. Always comes first.

p=none

The policy: none (monitor), quarantine (spam), or reject (block).

rua=mailto:

Where aggregate reports are sent, so you can see who sends as you.

fo=1

Failure-report options, for forensic detail on failing messages.

adkim=s / aspf=s

Strict alignment for DKIM and SPF. Relaxed (r) is the default.

np=reject

Policy for non-existent subdomains (RFC 9989). Stops subdomain spoofing.

t=y

Test mode: stage enforcement without acting on mail. Replaces the removed pct tag.

From monitoring to enforcement: p=none to reject

DMARC only stops spoofing at p=reject. Get there in three stages, without blocking your own mail:

  1. 1

    Publish a monitoring record

    Add a DMARC record with p=none and an rua address. It takes no action on your mail, but starts collecting reports on who is sending as your domain.

  2. 2

    Align SPF and DKIM

    Use the reports to find every legitimate sender and make each one pass SPF and DKIM in alignment. Keep SPF under 10 DNS lookups and confirm DKIM is signing.

  3. 3

    Move to quarantine, then reject

    Once your legitimate mail passes consistently, change the policy to p=quarantine, then p=reject. Only reject actually blocks spoofed mail.

Common mistakes this checker catches

  • A DMARC policy left on p=none forever, which monitors but never blocks spoofing.
  • More than one SPF record, which makes SPF fail entirely.
  • An SPF record over the 10 DNS-lookup limit, causing a PermError.
  • A missing -all or ~all qualifier on SPF.
  • No rua address, so you collect no DMARC reports.
  • No DKIM signing, or a record only at a selector you have not checked.

Focused checks for one record at a time

SPF checker

Validate your SPF record and count its DNS lookups.

DKIM checker

Discover DKIM selectors, or check a specific one.

DMARC generator

Build a valid DMARC record to publish.

Frequently asked questions

What is a DMARC record checker?

A DMARC record checker looks up the DMARC, SPF and DKIM records in your domain's DNS and tells you whether they are present, valid and correctly configured. Blankitt's checker reads the live records for any domain and flags issues such as a missing DMARC record, a policy left on p=none, or an SPF record with too many DNS lookups.

What does a valid DMARC record look like?

A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. A typical monitoring record is: v=DMARC1; p=none; rua=mailto:[email protected]. The v tag is the version, p is the policy (none, quarantine or reject), and rua is the address that receives aggregate reports. Start with p=none to monitor, then move to quarantine and reject once your legitimate mail passes.

What do p=none, p=quarantine and p=reject mean?

The p tag is your DMARC policy. p=none only monitors and takes no action on mail that fails authentication, so it is where you start. p=quarantine sends failing mail to spam. p=reject blocks failing mail outright and is the goal, since only reject actually stops spoofing of your domain.

Why is my SPF record failing?

The most common cause is too many DNS lookups. SPF allows a maximum of 10 (include, a, mx, ptr, exists and redirect all count), and exceeding it causes a PermError. Other causes are publishing more than one SPF record, or ending without a -all or ~all qualifier. This checker counts your lookups and flags each of these.

How do I check my DKIM record?

DKIM records live at selector._domainkey.yourdomain.com, where the selector is set by your email provider. Because the selector name is not fixed, this checker probes the common selectors used by Microsoft 365, Google Workspace, Mimecast, SendGrid and others. If you use a custom selector, the dedicated DKIM checker lets you enter it directly.

Is this DMARC checker free? Do I need an account?

Yes. The checker is free and needs no account or signup. It runs a live DNS lookup of the domain you enter and returns the result immediately. Ongoing monitoring, which parses your DMARC aggregate reports over time, is a separate product with a free tier.

How often should I check my DMARC record?

Check whenever you change DNS, add a new sending service, or move your DMARC policy towards enforcement. A one-off check confirms your current configuration; continuous monitoring alerts you when a record changes or a new sender appears, which a single check cannot.

Do I still use the pct tag?

No. RFC 9989 (DMARCbis, May 2026) removed the pct tag, and receivers ignore it. To stage enforcement, use t=y (test mode) instead, and set np= to give non-existent subdomains their own policy. This checker flags records that still carry pct.