Free tool
DMARC Checker & Record Generator
Look up any domain's DMARC record, see exactly what its policy does, then build a valid record with the free generator below. SPF, DKIM and MX are checked at the same time.
Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
Basics
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with mail that claims to be from your domain but fails authentication, and where to send reports about it.
Step 1
Message arrives
The From address claims to be your domain.
Step 2
SPF & DKIM run
The receiver checks both, as it would without DMARC.
Step 3
Alignment check
At least one of them must pass for the same domain as the From address.
Step 4
Policy applied
Failures are delivered, sent to spam or rejected, depending on p=.
Step 5
Reports sent
Daily aggregate reports go to the address in rua=.
- the host name where the TXT record lives
- _dmarc
- minimum policy Gmail, Yahoo and Outlook.com accept from bulk senders
- p=none
- daily messages that make DMARC mandatory
- 5,000+
- policies: none, quarantine, reject
- 3
Free generator
DMARC record generator
Pick a policy and a reporting address. Add the result as a TXT record at _dmarc on your domain. Starting out? Use p=none for two weeks and read the reports first.
Add this TXT record
- Type
- TXT
- Host / Name
- _dmarc
- Value
- v=DMARC1; p=none
Reference
DMARC tags explained
| Tag | Example | Meaning | Required? |
|---|---|---|---|
| v | v=DMARC1 | Version. Must be first. | Yes |
| p | p=quarantine | Policy for mail that fails: none, quarantine or reject. | Yes |
| rua | rua=mailto:[email protected] | Where daily aggregate reports are sent. | Recommended |
| ruf | ruf=mailto:[email protected] | Where per-message failure reports go. Few receivers send them. | Optional |
| pct | pct=25 | Percentage of failing mail the policy applies to. Defaults to 100. | Optional |
| sp | sp=reject | Policy for subdomains. Defaults to p. | Optional |
| adkim / aspf | adkim=s | Alignment mode: r (relaxed, the default) or s (strict). | Optional |
| fo | fo=1 | When to generate failure reports. | Optional |
DMARC policies compared
| Policy | What happens to failing mail | When to use it |
|---|---|---|
| p=none | Delivered as normal; you only get reports. | The first 1–2 weeks, to find every service sending as you. |
| p=quarantine | Sent to the spam folder. | Once reports show all legitimate mail passing. |
| p=reject | Blocked before delivery. | The end goal: full protection against spoofing. |
Rollout
A safe path from p=none to p=reject
Tighten the policy in steps and read your aggregate reports between each one. If a legitimate sender shows up failing, fix its SPF or DKIM before moving on.
Share of failing mail your policy acts on, by week
Suggested schedule. Only move to the next step when reports show all legitimate senders passing.
| Wk 1–2 none | 0% |
|---|---|
| Wk 3 quarantine | 25% |
| Wk 4 quarantine | 50% |
| Wk 5 quarantine | 100% |
| Wk 6+ reject | 100% |
- Week 1–2: publish
v=DMARC1; p=none; rua=mailto:[email protected]and collect reports. - Week 3–5: switch to
p=quarantineand raisepctfrom 25 to 100. - Week 6 onward: move to
p=reject. Keep reading reports whenever you add a new sending service.
Sending reports to another domain?
yourdomain.com._report._dmarc.theirdomain.com with the value v=DMARC1. Without it, receivers won't send the reports. Most reporting services set this up for you.DMARC only passes when SPF or DKIM does. Check both with the SPF record checker, or let Jetmail publish all three records automatically with your Google Workspace mailboxes.
Get your DMARC rollout plan
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
How do I check my DMARC record?
Enter your domain in the checker above. It looks up the TXT record at _dmarc.yourdomain.com, explains the policy and flags missing tags. From a terminal, run: dig TXT _dmarc.yourdomain.com +short
What does "DMARC policy not enabled" mean?
Your domain either has no DMARC record or has one set to p=none, which only monitors. Mail that fails authentication is still delivered. Move to p=quarantine and then p=reject once your reports show every legitimate sender passing.
Is DMARC required?
For bulk senders, yes. Since February 2024 Gmail and Yahoo require a DMARC record (p=none or stricter) from anyone sending more than 5,000 messages a day to their users, and Microsoft added the same requirement for Outlook.com in May 2025. Every sending domain should have one regardless.
What is a DMARC fail?
A message fails DMARC when neither SPF nor DKIM passes in alignment with the domain in the visible From address. The receiver then applies your policy: deliver anyway (none), send to spam (quarantine) or block it (reject).
Will p=reject hurt my cold email deliverability?
No. If your mailboxes are set up correctly, SPF and DKIM pass in alignment and p=reject only affects spoofed mail. Receivers tend to trust domains with an enforced policy more, not less.
Does every outreach domain need its own DMARC record?
Yes. Each root domain you send from needs its own _dmarc record. Subdomains inherit the parent domain's policy unless the parent sets a different sp= tag or the subdomain publishes its own record.