DMARC Lookup
Validate your DMARC record. Check policy strength, alignment modes, reporting configuration and get recommendations to move from monitoring to enforcement.
What Is a DMARC Lookup?
A DMARC lookup queries the _dmarc subdomain of a domain to retrieve its DMARC TXT record. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication standard that builds on SPF and DKIM. It tells receiving mail servers what to do when an inbound message fails both SPF and DKIM checks — and critically, it enables domain owners to receive reports about who is sending email on their behalf.
For example, the DMARC record for example.com is stored at _dmarc.example.com as a TXT record. Running a DMARC lookup on that domain retrieves this record and parses its tags — policy (p=), subdomain policy (sp=), percentage (pct=), aggregate report address (rua=), and forensic report address (ruf=).
This tool performs a live DMARC lookup and validates the record against RFC 7489. Common issues it catches include missing records, invalid policy values, misconfigured alignment modes, and rua addresses pointing to domains without external reporting authorization. Use it alongside the SPF Checker and DKIM Checker for a complete email authentication audit.
DMARC Policy Levels
| Policy | What happens to failing mail | Use case |
|---|---|---|
p=none | Delivered normally — monitoring only | Initial deployment, visibility |
p=quarantine | Moved to spam/junk folder | Transitional enforcement |
p=reject | Rejected at SMTP — never delivered | Full anti-spoofing protection |
Frequently Asked Questions
How do I perform a DMARC lookup?
Enter your domain name in the field above and click "Check DMARC". The tool queries _dmarc.yourdomain.com for a TXT record and validates every tag. You can also run a DMARC lookup from the command line with nslookup -type=TXT _dmarc.example.com or dig TXT _dmarc.example.com.
What is DMARC and why does it matter?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication policy that builds on SPF and DKIM. It tells receiving mail servers what to do when a message fails authentication — nothing (p=none), move to spam (p=quarantine), or reject (p=reject). It also provides aggregate and forensic reporting so you can see who is sending email claiming to be from your domain. Without DMARC, anyone can spoof your domain in the "From" address.
What is the difference between p=none, p=quarantine and p=reject?
p=none is monitor-only mode — unauthenticated mail is still delivered and you receive reports. p=quarantine instructs receivers to send failing mail to the spam folder. p=reject is enforcement mode — receivers drop unauthenticated messages entirely. Start with p=none, analyse the reports for a few weeks, then escalate to p=quarantine and finally p=reject.
What are the rua and ruf tags in a DMARC record?
rua specifies the email address that receives aggregate reports (daily XML summaries of all mail claiming to be from your domain). ruf specifies where forensic reports (individual failure samples) are sent. Most organisations configure rua for ongoing monitoring; ruf is optional and many senders skip it.
How do I move from p=none to p=reject safely?
Start with p=none and an rua address. After one to two weeks of reports, identify all legitimate sending services (ESP, CRM, support tools) and ensure each has valid SPF and DKIM alignment. Then step to p=quarantine; pct=10 (apply policy to 10% of mail), increasing pct gradually over several weeks. Once pct reaches 100 with no legitimate mail affected, switch to p=reject.
Why does my DMARC lookup return "not found"?
A DMARC lookup returns "not found" when there is no TXT record at _dmarc.yourdomain.com. This means your domain has no DMARC policy and is unprotected against spoofing. Create a minimal record to start monitoring: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Publish it as a TXT record at _dmarc.yourdomain.com in your DNS provider.