DMARC Record Checker & Builder

DMARC is what actually tells receiving mail servers what to do with a message that fails SPF or DKIM — and where to send reports about it. SPF and DKIM alone don't do that; DMARC is the policy layer that sits on top of both. Check what's published now, or build a new policy field-by-field below.

📖 Guide: How DMARC works, and how to roll it out safely

Last updated: September 10, 2026

How to use this tool

Enter your domain and click "Check current record" (Step 1) to see what's published now — its policy tier, percentage, and report addresses.
Setting DMARC up for the first time? Start at p=none (monitor-only) so nothing legitimate gets blocked while you watch the reports come in.
Fill in Step 2's fields and copy the generated record.
Publish it as a TXT record at _dmarc.yourdomain.com through your DNS provider.
Once a few weeks of aggregate reports confirm your real mail sources pass SPF/DKIM, move p= to quarantine, then eventually reject.

Sample record

A safe starting point — monitor-only, with aggregate reports flowing so you can see what's actually sending mail as your domain before you enforce anything:

v=DMARC1; p=none; rua=mailto:[email protected]; pct=100

Once reports confirm every legitimate source passes, the same record moved to enforcement looks like this, published at _dmarc.example.com:

v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; adkim=s; aspf=s

It's needed because SPF and DKIM only check technical details most recipients never see. DMARC is what ties them to the visible "From" address, tells receivers what to actually do about mail that fails, and gives you reports on who's sending mail as your domain — legitimate services and spoofers alike.

Domain

Step 1: Check what's published now

See the current policy, percentage, and report addresses before you replace them.

Step 2: Build your new record

Policy for this domain (p=)

Subdomain policy (sp=)

Applies to what percentage of mail? (pct=)

Aggregate report address(es) (rua=)

Forensic report address(es) (ruf=, optional)

Separate multiple addresses with commas. The mailto: prefix is added automatically — just enter the address(es).

Advanced: alignment mode & forensic reporting

DKIM alignment (adkim=)

SPF alignment (aspf=)

Failure reporting options (fo=)

Generated record

v=DMARC1; p=none

Which values should I actually use?

p= (required)	Start at `none` so nothing is blocked while you watch reports. Once you're confident every legitimate source passes SPF or DKIM alignment, move to `quarantine` (spam folder), then `reject` (refused outright).
sp=	Leave unset unless subdomains need a different policy than the one above — by default they inherit it. Useful if you have unused subdomains you want at `reject` immediately while the main domain is still at `none`.
pct=	What share of mail the policy applies to, as a gradual rollout. Leave at 100 once you're past initial testing — a policy at less than 100% still lets some failing mail through untouched.
rua=	Where daily aggregate reports (who sent mail as you, and whether it passed) get emailed. Set this from day one — it's the only way to know what enforcing would actually break.
ruf=	Forensic, per-message failure reports. Optional, higher volume, and not every receiver sends them — most domains run on `rua=` alone.
adkim= / aspf=	Relaxed (default) accepts any subdomain match; strict requires an exact domain match. Leave both relaxed unless you have a specific reason to tighten them — strict mode is easy to accidentally break with legitimate subdomain-sending setups.