MailTraceKit.me

DMARC · RFC 7489

DMARC Record Checker

Find the DMARC policy that applies to a domain, see what each tag does, check where reports go and how strongly spoofed mail is blocked.

Lookup

DNS over HTTPS · Cloudflare 1.1.1.1
Try:

How the DMARC checker works

Enter a domain and press Check DMARC. The checker queries _dmarc.<domain>. If nothing is published there, it falls back to the organisational domain, exactly as receivers do: for mail.example.co.uk that is example.co.uk, worked out with the Public Suffix List. The subdomain policy sp= then applies.

What the verdict means

  • Enforced: p=quarantine or p=reject for all failing mail. Spoofed messages go to spam or are refused.
  • Partly enforced: an enforcing policy limited by a pct below 100, or in test mode with t=y.
  • Monitoring only: p=none. You receive reports, but spoofed mail is still delivered.

The alignment tags decide how closely domains must match. Relaxed (r, the default) accepts any subdomain of the same organisational domain; strict (s) needs an exact match. When rua sends reports to another domain, that domain must publish an authorisation record at <your-domain>._report._dmarc.<their-domain>, and the checker looks it up for you.

To create or tighten a policy, use the DMARC record generator.

Frequently asked questions

What is the difference between p and sp?

p is the policy for the domain itself and sp the policy for its subdomains. Without sp, subdomains inherit p. A domain that never sends from subdomains can safely use the same or a stricter value for sp.

What does pct do?

pct applies the policy to only part of the failing mail; the rest is handled one step weaker, so quarantine becomes none and reject becomes quarantine. It exists for gradual rollouts, and the updated DMARC specification replaces it with the t= test flag.

Why do external report addresses need an extra record?

So that nobody can flood a stranger’s mailbox with reports, receivers only send reports to another domain if that domain publishes a TXT record saying it accepts them. Report services set this up for their customers.

Why is my DMARC policy shown as inherited?

No record exists at _dmarc for the exact name you entered, so receivers use the record of the organisational domain instead. For subdomains this is normal and expected.