What is a DMARC record?

A DMARC record is a DNS TXT record at _dmarc.yourdomain that tells receiving servers what to do with mail failing SPF or DKIM — none, quarantine or reject — and where to send reports.

Which DMARC policy should I start with?

Begin with p=none to monitor via reports, then move to p=quarantine and finally p=reject once your legitimate mail reliably passes SPF and DKIM alignment.

What are the rua and ruf tags?

rua is where daily aggregate reports (XML summaries of authentication results) are sent; ruf is for per-message forensic/failure reports. Point rua at a mailbox or a DMARC analytics service.

Does DMARC require SPF and DKIM?

Yes — DMARC builds on both. A message passes DMARC when it passes SPF or DKIM and the passing domain aligns with the visible From domain. You need at least one aligned pass.

What is the pct tag for?

pct applies your policy to only a percentage of mail (e.g. pct=25), letting you roll out quarantine or reject gradually instead of all at once.

DMARC Record Look Up

Related tools

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

DMARC (published at _dmarc.yourdomain.com) tells receivers what to do when a message claiming to be from your domain fails SPF/DKIM alignment — nothing (none), spam-folder it (quarantine), or reject it — and where to send aggregate reports.

How to read your result

Look at the p= policy and whether a rua= reporting address exists. p=none with reports is a legitimate starting state; staying there forever gives visibility without protection. Aggregate (rua) reports arrive as a daily XML summary from each receiver and show who sends as you and whether they align — they carry no message content. Failure/forensic (ruf) reports are per-message and controlled by the fo tag, but most large providers no longer send them, so plan around aggregate reports.

Common problems and how to fix them

No DMARC record at all

How it shows up: Anyone can spoof your exact domain in phishing mail and receivers have no instruction to stop it; you also have zero visibility into who sends as you.

How to fix it: Start with "v=DMARC1; p=none; rua=mailto:[email protected]" — it changes nothing about delivery but starts the reporting stream. Use the DMARC generator tool to build the record.

Stuck at p=none indefinitely

How it shows up: Reports flow but spoofed mail still reaches inboxes months later.

How to fix it: Review a few weeks of reports; once every legitimate source passes, move to p=quarantine (optionally with pct=25 ramping to 100), then p=reject. This staged rollout is the entire point of DMARC.

Enforcement broke legitimate mail

How it shows up: After moving to quarantine/reject, mail from some internal tool or third-party sender started disappearing.

How to fix it: That sender was never properly authenticated. Add it to SPF and/or set up DKIM signing for it, verify in reports, then restore enforcement — dropping back to p=none permanently would surrender the protection.

Reports go nowhere or overwhelm a personal inbox

How it shows up: The rua mailbox bounces (invalidating your reporting) or fills with XML attachments nobody reads.

How to fix it: Point rua at a dedicated mailbox or a DMARC report-processing service, and make sure the address actually accepts mail from external senders.

Not sure how to read the reports, or the fo tag never yields failure reports

How it shows up: Daily XML aggregate reports arrive but you cannot tell which sources are legitimate, or you set a ruf address and fo option but never receive failure reports.

How to fix it: Read aggregate reports source by source: confirm each IP is really yours, then get any legitimate sender that is not aligned to pass SPF or DKIM alignment before tightening the policy. The fo tag only governs failure (ruf) reports (fo=1 requests one when either SPF or DKIM fails alignment) — but since large receivers rarely send ruf reports, treat it as a bonus, not your main signal. Paste a report into the DMARC report parser to read it.

Frequently asked questions

What is a DMARC record?: A DMARC record is a DNS TXT record at _dmarc.yourdomain that tells receiving servers what to do with mail failing SPF or DKIM — none, quarantine or reject — and where to send reports.
Which DMARC policy should I start with?: Begin with p=none to monitor via reports, then move to p=quarantine and finally p=reject once your legitimate mail reliably passes SPF and DKIM alignment.
What are the rua and ruf tags?: rua is where daily aggregate reports (XML summaries of authentication results) are sent; ruf is for per-message forensic/failure reports. Point rua at a mailbox or a DMARC analytics service.
Does DMARC require SPF and DKIM?: Yes — DMARC builds on both. A message passes DMARC when it passes SPF or DKIM and the passing domain aligns with the visible From domain. You need at least one aligned pass.
What is the pct tag for?: pct applies your policy to only a percentage of mail (e.g. pct=25), letting you roll out quarantine or reject gradually instead of all at once.