DMARC Scorer
Analyse your DMARC policy enforcement level, alignment settings, and reporting configuration.
What is DMARC?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) ties together SPF and DKIM by specifying a policy for what to do with emails that fail those checks. It also provides reporting so you can monitor authentication failures.
Policy Levels
- •
p=none— monitor only, no enforcement - •
p=quarantine— failing mail goes to spam - •
p=reject— failing mail is blocked entirely
What this DMARC checker looks up
The checker queries the TXT records at _dmarc.yourdomain.com using public resolvers (1.1.1.1 and 8.8.8.8), retrying once on a timeout or SERVFAIL. It picks the record that begins with v=DMARC1, splits it into tags and returns the policy, subdomain policy, percentage, report addresses, alignment modes and failure options, plus a pass, warn or fail verdict with plain-language recommendations.
It reads your published DNS record only. It does not send test mail and it does not look at real authentication results. To see whether a specific message passed DMARC, paste its headers into the email header analyzer; to see how your senders perform at volume, read your aggregate reports.
How the verdict is decided
| Situation | Verdict | What it means |
|---|---|---|
| No v=DMARC1 record at _dmarc.<domain> | Fail | Nobody can see or enforce how your domain is used. Publish at least p=none with a rua address. |
| p=none | Warn | Monitoring only. Spoofed and failing mail is still delivered normally. |
| p=quarantine or p=reject with pct below 100 | Warn | Only that percentage of failing mail gets the policy; the rest gets the next weaker treatment (quarantine for reject, none for quarantine). |
| p=quarantine, pct=100, with rua | Pass | Failing mail goes to spam. The checker suggests moving to reject when you are ready. |
| p=reject, pct=100, with rua | Pass | Full enforcement with reporting. |
| Any enforcing policy but no rua | Warn | You are enforcing blind: you cannot see which legitimate senders are being blocked. |
How to read each result field
- Record: the raw TXT string as published. Check it starts with v=DMARC1 and that tags are separated by semicolons.
- Policy (p=): none, quarantine or reject. This is the instruction for mail sent from your exact domain.
- Subdomain (sp=): shown only if present. When it is absent, subdomains inherit p=. A common pattern is p=reject on the main domain and sp=reject for parked subdomains that never send mail.
- Enforcement %: the pct value, 100 when omitted.
- Aggregate Reports: the rua destinations. These receive daily XML summaries from receivers.
- Forensic Reports: the ruf destinations, shown only if set. Many large receivers, Gmail among them, do not send forensic reports at all.
- DKIM Alignment and SPF Alignment: shown only when adkim or aspf is in the record. Relaxed (r) lets a subdomain of the From domain align; strict (s) needs an exact match. Omitted means relaxed.
DMARC tag reference
These are the tags defined in RFC 7489. Only v and p are required.
| Tag | Values | Default | Purpose |
|---|---|---|---|
| v | DMARC1 | required | Version. Must be the first tag. |
| p | none, quarantine, reject | required | Policy for the domain. |
| sp | none, quarantine, reject | same as p | Policy for subdomains. |
| rua | mailto: URI list | none | Where aggregate reports are sent. Separate multiple URIs with commas. |
| ruf | mailto: URI list | none | Where failure (forensic) reports are sent. |
| pct | 0 to 100 | 100 | Share of failing mail the policy applies to. |
| adkim | r or s | r | DKIM alignment mode. |
| aspf | r or s | r | SPF alignment mode. |
| fo | 0, 1, d, s (colon separated) | 0 | When to generate failure reports: 0 when all mechanisms fail, 1 when any fails, d for DKIM failure, s for SPF failure. |
| ri | seconds | 86400 | Requested interval between aggregate reports. |
Common DMARC errors and how to fix them
| Symptom | Likely cause | Fix |
|---|---|---|
| Checker reports no record | Record published at the root, at dmarc.example.com, or on the wrong host name | The name must be _dmarc.example.com. In most DNS panels you enter only _dmarc as the host. |
| Record exists but is not picked up | Typo such as v=DMARC 1, or a missing semicolon between tags | Use exactly v=DMARC1; p=none; rua=mailto:dmarc@example.com |
| Two DMARC records | A second record was added instead of editing the first | Keep one. Receivers are told to ignore the policy when multiple DMARC records are found. |
| rua=dmarc@example.com | Missing mailto: prefix | Write rua=mailto:dmarc@example.com |
| Reports never arrive from a third-party mailbox | The report address is on a different domain with no authorization | The receiving domain must publish a TXT record at example.com._report._dmarc.reportdomain.com containing v=DMARC1. Reporting services normally tell you this. |
| Mail fails DMARC although SPF and DKIM pass | Neither passing domain aligns with the From domain, which is typical of third-party senders using their own return-path and signing domain | Configure custom DKIM signing for your domain at the sender, then re-check. |
| Warning about pct | pct left below 100 after a staged rollout | Raise to 100, or remove pct, once reports are clean. |
A staged path from p=none to p=reject
- Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com and confirm it with this checker.
- Collect aggregate reports for two to four weeks and list every source sending as your domain: mail platform, CRM, billing, helpdesk, newsletters.
- Fix each legitimate source so SPF or DKIM passes in alignment. Custom DKIM signing at third-party senders is usually the cleanest fix.
- Move to p=quarantine; pct=10, then step pct up (25, 50, 100) while watching reports and support tickets.
- Move to p=reject, again optionally stepping pct up. Add sp=reject if subdomains do not send mail.
- Re-run the checker after each DNS change. Remember DNS caching: results can lag by up to the record TTL.
The reasoning behind each stage is covered in the DMARC policy guide, and reading the XML reports is covered in the aggregate reports guide linked below.
What this checker does not do
- It does not fall back to the organizational domain. If you check a subdomain with no record of its own, the tool reports no record, whereas a real receiver would apply the parent domain's policy.
- It does not test report authorization for external rua or ruf addresses, or validate the syntax of the mailto: URIs.
- It does not verify that p holds a valid value. A record with a missing or misspelled p tag is returned without a policy and is not flagged as an error, so read the Record line yourself.
- It does not run a live alignment test and does not show the ri or rf tags.
- Results reflect what public resolvers return at the moment of the check, not what your own DNS provider has pending.
Related tools and guides
Frequently Asked Questions
What is DMARC and how does it protect my domain?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS policy that tells receiving mail servers what to do with emails that fail SPF or DKIM checks. It also sends aggregate reports showing authentication results across all mail sent from your domain. Without DMARC, anyone can spoof your domain in phishing attacks. Setting DMARC to p=reject blocks unauthenticated email entirely.
What is the difference between p=none, p=quarantine, and p=reject?
p=none is monitoring-only mode — failed emails are delivered as normal, but DMARC reports are sent. p=quarantine sends failed emails to the spam or junk folder. p=reject is full enforcement — receiving servers should reject unauthenticated email entirely. The standard approach is to move from none to quarantine to reject gradually as you confirm all legitimate senders pass authentication.
How long does it take to safely move to DMARC p=reject?
Most domains can move from p=none to p=reject in 4–8 weeks by: setting p=none with reporting URIs, reviewing aggregate reports for 2–4 weeks, identifying and fixing any failing senders, stepping to p=quarantine, then finally p=reject. Domains with many third-party senders — CRMs, marketing platforms, helpdesk tools — may take longer to audit all sending sources.
What is DMARC alignment?
DMARC alignment checks that the domain in SPF or DKIM matches the From: header domain that recipients see. Two modes exist: relaxed alignment (subdomains are allowed to match) and strict alignment (exact domain match required). If alignment fails, the email fails DMARC even if SPF and DKIM individually pass. Most domains should use relaxed alignment.
Does DMARC stop all phishing and spoofing attacks?
DMARC at p=reject prevents spoofing of your exact domain — for example, emails appearing to come from yourcompany.com. It does not stop lookalike domain attacks (typosquatting domains like yourcompany-inc.com) or display name spoofing where a different email address is hidden behind a familiar name. DMARC enforcement is the essential first layer of protection against direct domain impersonation.