Free tool
DMARC Checker & Record Generator
Look up any domain's DMARC record, see exactly what its policy does, then build a valid record with the free generator below. SPF, DKIM and MX are checked at the same time.
Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
Basics
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it.
Step 1
Message arrives
The From address claims to be your domain.
Step 2
SPF & DKIM run
The receiver checks both, as it would without DMARC.
Step 3
Alignment check
At least one of them must pass for the same domain as the From address.
Step 4
Policy applied
Failures are delivered, sent to spam or rejected, depending on p=.
Step 5
Reports sent
Daily aggregate reports go to the address in rua=.
- the host name where the TXT record lives
- _dmarc
- minimum policy Gmail, Yahoo and Outlook.com accept from bulk senders
- p=none
- daily messages that make DMARC mandatory
- 5,000+
- policies: none, quarantine, reject
- 3
Free generator
DMARC record generator
Pick a policy and a reporting address. Add the result as a TXT record at _dmarc on your domain. Starting out? Use p=none for two weeks and read the reports first.
Add this TXT record
- Type
- TXT
- Host / Name
- _dmarc
- Value
- v=DMARC1; p=none
Reference
DMARC tags explained
| Tag | Example | Meaning | Required? |
|---|---|---|---|
| v | v=DMARC1 | Version. Must be first. | Yes |
| p | p=quarantine | Policy for mail that fails: none, quarantine or reject. | Yes |
| rua | rua=mailto:[email protected] | Where daily aggregate reports are sent. | Recommended |
| ruf | ruf=mailto:[email protected] | Where per-message failure reports go. Few receivers send them. | Optional |
| pct | pct=25 | Percentage of failing mail the policy applies to. Defaults to 100. | Optional |
| sp | sp=reject | Policy for subdomains. Defaults to p. | Optional |
| adkim / aspf | adkim=s | Alignment mode: r (relaxed, the default) or s (strict). | Optional |
| fo | fo=1 | When to generate failure reports. | Optional |
DMARC policies compared
| Policy | What happens to failing mail | When to use it |
|---|---|---|
| p=none | Delivered as normal; you only get reports. | The first 1–2 weeks, to find every service sending as you. |
| p=quarantine | Sent to the spam folder. | Once reports show all legitimate mail passing. |
| p=reject | Blocked before delivery. | The end goal: full protection against spoofing. |
Rollout
A safe path from p=none to p=reject
Tighten the policy in steps and read your aggregate reports between each one. If a legitimate sender shows up failing, fix its SPF or DKIM before moving on.
Share of failing mail your policy acts on, by week
Suggested schedule. Only move to the next step when reports show all legitimate senders passing.
| Wk 1–2 none | 0% |
|---|---|
| Wk 3 quarantine | 25% |
| Wk 4 quarantine | 50% |
| Wk 5 quarantine | 100% |
| Wk 6+ reject | 100% |
- Week 1–2: publish
v=DMARC1; p=none; rua=mailto:[email protected]and collect reports. - Week 3–5: switch to
p=quarantineand raisepctfrom 25 to 100. - Week 6 onward: move to
p=reject. Keep reading reports whenever you add a new sending service.
Sending reports to another domain?
yourdomain.com._report._dmarc.theirdomain.com with the value v=DMARC1. Without it, receivers won't send the reports. Most reporting services set this up for you.DMARC only passes when SPF or DKIM does. Check both with the SPF record checker, or let Jetmail publish all three records automatically with your Google Workspace mailboxes.
Testing
DMARC tester: check a real email, not just the record
The checker above reads your DNS. A DMARC test goes one step further: it sends a real message and confirms SPF or DKIM passes in alignment with your From address.
- Send a normal email from the mailbox you want to test to a Gmail address you can open.
- In Gmail, open the message, click the three-dot menu and choose Show original.
- Look for DMARC: PASS in the summary at the top, or
dmarc=passin the Authentication-Results header. - Repeat for every service that sends as your domain: your outreach tool, CRM, helpdesk and billing system.
“No DMARC record found”: causes and fixes
| Cause | How to spot it | Fix |
|---|---|---|
| Never published | No TXT record exists at _dmarc. | Generate a record above |
| Wrong host name | The record sits at _dmarc.yourdomain.com.yourdomain.com. | Enter only _dmarc in the host field. |
| Doesn't start with v=DMARC1 | A typo, a missing tag, or extra characters before it. | Make v=DMARC1 the first tag, exactly. |
| Two DMARC records | Two TXT records at _dmarc. | Receivers ignore DMARC when there's more than one. Merge into one record. |
| Just added | Your DNS host shows it, the checker doesn't. | Wait for the TTL to expire and check again. |
Record found, but your test shows DMARC failing? That's an alignment problem, not a missing record. Work through the DMARC fail troubleshooting guide.
Google Workspace
Google Workspace DMARC setup
Google Workspace doesn't publish a DMARC record for you. You add it at your domain host, after SPF and DKIM are working.
- Turn on SPF and DKIM for the domain. Google recommends waiting 48 hours after that before adding DMARC. See the Google Workspace SPF record and DKIM setup guides.
- At your domain host, add a TXT record with the host name
_dmarc. - Start with Google's suggested monitoring policy and a reporting address:
Google Workspace starting DMARC record
v=DMARC1; p=none; rua=mailto:[email protected]You don't need to change anything in the Google Admin console. Google suggests a dedicated mailbox, a group or a reporting service for the rua address, because a busy domain can receive a lot of reports. Once they show all your legitimate mail passing, follow the rollout above to quarantine and reject.
Running many outreach domains?
Reports
DMARC aggregate reports, explained
Add a rua= tag and every server that receives mail from your domain sends you a report, usually once a day. Each report is an XML file summarizing what it saw.
Example: one record from an aggregate report (trimmed)
<record>
<row>
<source_ip>203.0.113.10</source_ip>
<count>42</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>pass</dkim>
<spf>pass</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>yourdomain.com</header_from>
</identifiers>
<auth_results>
<dkim><domain>yourdomain.com</domain><result>pass</result></dkim>
<spf><domain>yourdomain.com</domain><result>pass</result></spf>
</auth_results>
</record>| Field | What it tells you |
|---|---|
report_metadata | Which receiver sent the report and the date range it covers. |
policy_published | The DMARC policy the receiver found for your domain. |
source_ip | The server that sent mail as your domain. |
count | How many messages came from that IP in the period. |
policy_evaluated | Aligned DKIM and SPF results, and what the receiver did (disposition). |
auth_results | Raw SPF and DKIM results, including which domain each one checked. |
How to read them
- Group rows by source IP and identify each one: your mailbox provider, your outreach tool, your CRM.
- A known service failing? Fix its SPF include or DKIM signing before you tighten your policy.
- Unknown IPs failing are usually spoofing attempts, which is exactly what quarantine and reject stop.
Raw XML is hard to read at volume, so most teams forward reports to a reporting service that turns them into charts. Seeing failures you can't explain? The DMARC fail guide covers the common causes.
Get your DMARC rollout plan
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
How do I check my DMARC record?
Enter your domain in the checker above. It looks up the TXT record at _dmarc.yourdomain.com, explains the policy and flags missing tags. From a terminal, run: dig TXT _dmarc.yourdomain.com +short
What does "DMARC policy not enabled" mean?
Your domain either has no DMARC record or has one set to p=none, which only monitors. Mail that fails authentication is still delivered. Move to p=quarantine and then p=reject once your reports show every legitimate sender passing.
Is DMARC required?
For bulk senders, yes. Since February 2024 Gmail and Yahoo require a DMARC record (p=none or stricter) from anyone sending more than 5,000 messages a day to their users, and Microsoft added the same requirement for Outlook.com in May 2025. Every sending domain should have one regardless.
What is a DMARC fail?
A message fails DMARC when neither SPF nor DKIM passes in alignment with the domain in the visible From address. The receiver then applies your policy: deliver anyway (none), send to spam (quarantine) or block it (reject).
Will p=reject hurt my cold email deliverability?
No. If your mailboxes are set up correctly, SPF and DKIM pass in alignment and p=reject only affects spoofed mail. Receivers tend to trust domains with an enforced policy more, not less.
Does every outreach domain need its own DMARC record?
Yes. Each root domain you send from needs its own _dmarc record. Subdomains inherit the parent domain's policy unless the parent sets a different sp= tag or the subdomain publishes its own record.
What does "no DMARC record found" mean?
There is no valid TXT record at _dmarc.yourdomain.com. It was never published, it was added under the wrong host (for example _dmarc.yourdomain.com.yourdomain.com), it doesn't start with v=DMARC1, or DNS hasn't updated yet. Two DMARC records on the same host also count as none, because receivers ignore DMARC when there's more than one.
How do I set up DMARC for Google Workspace?
Turn on SPF and DKIM first and, as Google recommends, wait 48 hours. Then add a TXT record at _dmarc on your domain host, starting with v=DMARC1; p=none; rua=mailto:[email protected]. Nothing needs to change in the Google Admin console. Move to quarantine and reject once reports show your mail passing.
What is a DMARC aggregate report?
A summary that receiving mail servers email to the address in your rua= tag, usually once a day. It's an XML file listing each sending IP, how many messages it sent as your domain, their SPF, DKIM and DMARC results, and what the receiver did with them.