DMARC Checker
Check a DMARC record
Validate a domain’s DMARC policy against RFC 9989, the 2026 revision of the standard: policy discovery, obsolete tags, enforcement level and reporting.
Guide
What the DMARC checker tests
DMARC tells receivers what to do with mail that fails SPF and DKIM alignment, and where to report it. In May 2026 it was revised as RFC 9989, with reporting split into RFC 9990 and RFC 9991. This checker validates against the revision:
- Discovery by DNS tree walk. A subdomain without its own record is covered by the nearest parent that has one, using its
sp=policy, ornp=if the subdomain does not exist. - Syntax.
v=DMARC1must come first, exactly. Two records at the same name are discarded together. - Obsolete tags.
pct,rfandriwere removed. Updated receivers ignore them, so a staged rollout built onpctis not doing what it says. - Enforcement.
p=none, ort=yon top of a stronger policy, leaves the domain spoofable. - Reporting. Whether
rua=is set, and whether report addresses at other domains have authorised it.
DKIM is the one part DNS alone cannot show, because keys sit under selectors you cannot list. The report says so rather than assuming it is fine. See what changed in DMARC in 2026.
FAQ
DMARC: common questions
What is a DMARC record?
A DMARC record is a TXT record at _dmarc.<your domain>, starting with v=DMARC1. It tells receiving servers what to do with mail that claims to be from your domain but fails SPF and DKIM alignment (nothing, quarantine, or reject), and where to send reports about it.
What is RFC 9989?
RFC 9989, published in May 2026, is the revised DMARC standard. It replaces RFC 7489, removes the pct, rf and ri tags, adds np, psd and t, and replaces the Public Suffix List with a DNS tree walk for finding the policy that applies. Aggregate and failure reporting moved to RFC 9990 and RFC 9991.
Is pct still valid in DMARC?
Not under RFC 9989. pct was removed, and updated receivers ignore it. If you used pct to apply quarantine or reject to part of your mail, the closest replacement is t=y, which asks receivers to apply the policy one level lower while you test.
Is p=none enough?
No. p=none only asks for reports; mail that fails DMARC is delivered as normal, so the domain can still be spoofed. It is the right starting point while you identify your senders, followed by quarantine and then reject.
Guides
Learn more
- DMARCbis: what changed in DMARC in 2026 (RFC 9989) DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.
- Moving DMARC from p=none to p=reject A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.
- SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.