How to Check DMARC Records
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a DNS-published policy that tells receiving mail servers what to do when an email fails SPF and DKIM authentication. Checking a domain's DMARC record helps you understand its email security posture and troubleshoot authentication failures.
Method 1: Use a web-based DNS lookup tool
Use IPLookupHub's DNS Lookup tool to query TXT records for _dmarc.example.com. The DMARC record is always published at the _dmarc subdomain of the domain you are checking.
Method 2: Use dig on the command line
dig _dmarc.example.com TXTA typical DMARC record looks like:
"v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=r"Method 3: Use nslookup
nslookup -type=TXT _dmarc.example.comUnderstanding DMARC tags
| Tag | Meaning | Example |
|---|---|---|
v | DMARC version (always DMARC1) | v=DMARC1 |
p | Policy: none, quarantine, or reject | p=reject |
sp | Subdomain policy (inherits from p if absent) | sp=quarantine |
rua | Aggregate report destination | rua=mailto:[email protected] |
ruf | Forensic (failure) report destination | ruf=mailto:[email protected] |
adkim | DKIM alignment mode (r=relaxed, s=strict) | adkim=s |
aspf | SPF alignment mode (r=relaxed, s=strict) | aspf=r |
pct | Percentage of messages to apply policy to | pct=50 |
DMARC policy rollout
Most organizations deploy DMARC gradually:
- Start with
p=noneand configureruareporting. This monitors authentication results without affecting delivery. - Move to
p=quarantineafter reviewing reports and ensuring legitimate senders pass SPF and DKIM. - Advance to
p=rejectwhen you are confident all authorized sources are properly authenticated.
The pct tag can be used during transitions to apply the policy to only a percentage of messages (e.g., pct=10 to start cautiously).
Common mistakes
- Publishing at the wrong location: DMARC must be at
_dmarc.example.com, not at the root domain. - Jumping to
p=rejecttoo quickly: without reviewing reports first, you may block legitimate email from third-party services. - No reporting address: without
rua, you have no visibility into authentication results. - Ignoring subdomain policy: if
spis not set, subdomains inherit the parent domain's policy, which may not be the intended behavior.
Frequently asked questions
What is a DMARC record?
A DMARC record is a DNS TXT record published at _dmarc.example.com that tells receiving mail servers how to handle messages that fail SPF and DKIM authentication checks.
What do the DMARC policy values mean?
p=none means monitor only (no action). p=quarantine means move suspicious mail to spam. p=reject means reject messages that fail authentication.
What is DMARC alignment?
DMARC alignment checks whether the domain in the From header matches the domain validated by SPF or DKIM. Relaxed alignment allows subdomains to match; strict alignment requires an exact match.
What are DMARC aggregate reports?
DMARC aggregate reports (rua) are XML reports sent by receiving servers to the address specified in the DMARC record. They show how many messages passed or failed SPF/DKIM checks for the domain.