Free DMARC Record Checker

What is DMARC and Why It Matters in 2026

DMARC — Domain-based Message Authentication, Reporting & Conformance — is the policy layer that ties SPF and DKIM together. SPF tells receiving servers which IPs are allowed to send mail for your domain. DKIM cryptographically signs each message so recipients can verify it wasn't tampered with. DMARC is the instruction manual: it tells Gmail, Outlook, Yahoo, and every other inbox provider what to do when a message claiming to come from your domain fails one or both of those checks. Without DMARC, attackers can spoof your From address and ride your reputation straight into customer inboxes.

In 2026 this is no longer optional. Since February 2024 — and tightened steadily through 2025 and 2026 — Gmail and Yahoo require any sender pushing more than 5,000 messages per day to have a valid DMARC record. Microsoft 365 has followed with its own enforcement for high-volume senders. Domains without DMARC see bulk mail bounced or routed straight to spam, and brand-impersonation phishing rates roughly double when DMARC is missing.

Anatomy of a DMARC Record

A DMARC record is a single TXT record published at _dmarc.yourdomain.com. It is a semicolon-delimited list of tags. Here is a typical record and what each piece does:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100; aspf=r; adkim=r;

• v=DMARC1 — Required version tag. Must be exactly DMARC1 (case-sensitive) or the entire record is ignored.
• p= — The policy itself. p=none means monitor only — failures still get delivered. p=quarantine sends failing mail to the spam folder. p=reject blocks it outright at the SMTP boundary.
• rua= — Aggregate report mailbox. Receivers send daily XML reports here summarising which IPs sent mail using your domain and how many messages passed or failed. Format: rua=mailto:dmarc-reports@yourdomain.com.
• ruf= — Forensic (failure) report mailbox. Per-message failure samples with headers and sometimes redacted body. Most providers no longer send these for privacy reasons, so rua is far more useful in practice.
• pct= — Percentage of failing mail to apply the policy to (1–100). Lets you stage rollouts: pct=25 with p=quarantine quarantines a quarter of failures while leaving 75% delivered.
• aspf= / adkim= — Alignment mode. aspf=s/r and adkim=s/r control whether SPF/DKIM domain matching is strict (exact match) or relaxed (subdomain allowed). Default is relaxed, which is what almost everyone wants.

5 Common DMARC Errors and How to Fix Them

Error: No DMARC record found

The most common failure mode. Run dig TXT _dmarc.yourdomain.com — if it returns nothing, the record is missing. Check three things: (1) you published the TXT record on _dmarc as a subdomain, not on the root domain; (2) the host field is exactly _dmarc with a leading underscore (some DNS UIs strip it); (3) you waited for propagation. TTL is typically 300–3600 seconds, but Cloudflare and Route53 are usually live within a minute. Avoid uppercase _DMARC — DNS labels are case-insensitive but some validators are strict.

Error: Multiple DMARC records

If two or more TXT records exist on _dmarc, RFC 7489 requires receivers to ignore all of them — your domain falls back to no policy. This often happens when a marketing tool or migration script publishes a second record without removing the first. Run dig +short TXT _dmarc.yourdomain.com — if you see more than one v=DMARC1 line, delete the older or weaker one. Consolidate everything into a single record with all the tags you need (p, rua, ruf, pct, aspf, adkim).

Error: Invalid syntax

DMARC parsers are strict. The five most common syntax errors: (1) missing semicolons between tags — every tag pair must end with ;; (2) using = signs in mailto URIs without proper encoding; (3) using smart-quotes copy-pasted from a Word doc instead of straight ASCII quotes; (4) typos like p=quarentine or p=rejct; (5) wrapping the whole record in extra quotes when the DNS UI already adds them. Validate with our checker above — it parses tag-by-tag and tells you exactly which token failed.

Error: SPF/DKIM alignment failures

DMARC passes only when at least one of SPF or DKIM both authenticates and aligns with the From domain. A common gotcha: your ESP (e.g. Mailchimp) authenticates with its own return-path like bounces.mcsv.net, so SPF passes but doesn't align with yourdomain.com. Fix by enabling DKIM signing with your domain on the ESP — DKIM alignment is easier than SPF alignment because the d= tag in the DKIM signature can match your root domain. For subdomains, set aspf=r and adkim=r (relaxed, the default) so subdomain mail aligns with the root.

5-Step DMARC Setup Walkthrough

1. Audit current authentication — Before you publish DMARC, fix SPF and DKIM. Run our SPF Checker and DKIM Checker on every sending domain and subdomain. Confirm SPF is under the 10-DNS-lookup limit and ends in -all or ~all. Confirm DKIM is signing with a 2048-bit key and aligned with your From domain.
2. Publish a monitoring record (p=none) — Add this TXT record at host _dmarc: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100; aspf=r; adkim=r. p=none means no impact on mail flow — receivers will start sending you aggregate reports without quarantining or rejecting anything. This is your data-collection phase. Use a dedicated mailbox or a DMARC analyser tool because raw XML is unreadable at scale.
3. Collect aggregate reports — Within 24 hours you should start receiving daily XML reports from major receivers. Parse them to identify every IP and platform sending mail as your domain. Expected senders (Google Workspace, Mailchimp, SendGrid) should pass. Unexpected ones are either shadow IT or spoofers — investigate before you tighten the policy.
4. Move to quarantine with pct=25 — Once 95%+ of legitimate mail is passing both SPF and DKIM with alignment, tighten to v=DMARC1; p=quarantine; pct=25; rua=...;. Now 25% of failing mail goes to spam. Watch reports and helpdesk tickets for false positives. After two clean weeks, raise pct to 50, then 100.
5. Reach p=reject — Final state: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100;. Failing mail is bounced at the SMTP boundary — phishers can no longer spoof your domain. This is the only configuration that fully protects your brand. Most domains reach reject within 8 weeks of starting at p=none.

DMARC Rollout Phases (4 to 8 Weeks)

A safe DMARC rollout follows a percentage-based ramp so you can catch misconfigurations before they hurt deliverability. The minimum viable timeline is four weeks; eight is safer for organisations with many sending platforms.

• Week 1-2: Monitor (p=none) — Publish p=none with rua= reporting. Collect aggregate reports, identify every legitimate sender, and fix SPF/DKIM gaps. Expect to discover at least one shadow ESP nobody told IT about.
• Week 3-4: Quarantine pct=25 — Switch to p=quarantine; pct=25. A quarter of unauthenticated mail now lands in spam. Monitor reports daily for unexpected drops in legitimate mail. If a sender breaks, roll back to p=none, fix it, retry.
• Week 5-6: Quarantine pct=100 — Raise to p=quarantine; pct=100. All failing mail goes to spam. By this point your reports should show 99%+ pass rates from known senders. Spoofed mail attempting your domain is now neutralised at the recipient inbox.
• Week 7-8: Reject — Move to p=reject; pct=100. Failing mail is bounced at the SMTP transaction — never reaches the recipient at all. This is the destination state. Keep reporting on (rua=) so you spot regressions when a new ESP is added.

Gmail and Yahoo 2026 Requirements

If you send more than 5,000 messages per day to Gmail or Yahoo addresses, DMARC is mandatory. The minimum acceptable record is p=none — but Google's own guidance now recommends p=quarantine or stronger. Without a valid DMARC record, bulk senders see messages bounce with 5.7.26 'unauthenticated email is not accepted' or get routed straight to spam regardless of content. The other 2026 requirements stack on top: one-click unsubscribe in headers, spam-complaint rates under 0.3%, and TLS for SMTP. DMARC is the cheapest of these to implement — typically a single TXT record and 30 minutes of work — and it is the single biggest deliverability lever for transactional and marketing mail.