How to Check a DMARC Record

DMARC is not published at the root domain like SPF. A DMARC policy is usually stored as a TXT record at _dmarc.example.com rather than example.com.

If you only check the root domain's TXT records, you can easily miss a perfectly valid DMARC record.

• DMARC Checker
• TXT Lookup

A valid DMARC policy starts with v=DMARC1 and is followed by semicolon-separated tags. If that prefix is missing, the TXT record is not a valid DMARC policy even if it contains familiar-looking values.

You should also confirm that there is only one effective DMARC record for the hostname being checked.

• p shows the requested policy such as none, quarantine, or reject
• rua lists aggregate reporting destinations
• ruf lists forensic reporting destinations when used
• adkim controls DKIM alignment mode
• aspf controls SPF alignment mode
• pct shows what percentage of mail the policy should apply to

For a quick check, p, rua, adkim, and aspf usually tell you most of what you need to know about the domain's DMARC posture.

• p=none means monitoring without enforcement
• p=quarantine asks receivers to treat failing mail as suspicious
• p=reject asks receivers to reject failing mail

A stricter policy is not automatically better if legitimate senders are still failing SPF and DKIM alignment. The goal is to match the policy to the domain's actual sending environment.

Many domains publish DMARC but never really use it because the aggregate reports are missing, misdirected, or not monitored. Checking the rua destinations is part of checking whether the policy is operationally useful, not just technically valid.

If third-party report addresses are used, they also need the right authorisation in place.

• How to interpret DMARC reports
• What is DMARC and how does it work?

• No DMARC record exists at all
• The record is published at the wrong hostname
• The record uses invalid syntax or unsupported tags
• The policy is stricter than the real sending environment can support
• Reporting addresses are missing or not being monitored

• Query _dmarc.yourdomain for TXT records
• Confirm there is one valid record starting with v=DMARC1
• Review p, rua, adkim, aspf, and pct
• Check whether SPF and DKIM are likely to align for your real senders
• Use report data and header evidence before moving to stricter enforcement

If you want to validate this topic in practice, these DNS Pro tools are the fastest next step.

• DMARC Checker
• Email Security Check
• Email Header Analysis