DMARC Lookup
Check and analyze DMARC records for email authentication
This page provides original, human-reviewed information about DMARC policy checking, explaining p/quarantine/reject policies, alignment modes, and how reporting URIs feed aggregate feedback to domain owners.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds upon SPF and DKIM to provide comprehensive protection against email spoofing, phishing, and domain abuse.
How DMARC Works:
- You publish a DMARC policy in your DNS records
- When an email claiming to be from your domain is received, the recipient's mail server checks yourDMARC policy
- The server verifies SPF and/or DKIM authentication
- It checks if the authenticated domain aligns with the "From" header domain
- Based on your policy, the email is delivered, quarantined, or rejected
- Reports are sent back to you about authentication results
DMARC Policy Options:
No action taken, only collect reports
Mark suspicious emails as spam
Block unauthorized emails completely
Benefits of DMARC:
- Prevents domain spoofing and phishing attacks
- Improves email deliverability and sender reputation
- Provides visibility into email authentication failures
- Enables gradual policy enforcement with percentage controls
- Protects brand reputation and customer trust
- Required for many compliance frameworks
Step 1: Create DMARC Record
Add a TXT record to your DNS at _dmarc.yourdomain.com
Basic DMARC Record (Monitor Only)
Start with monitoring to understand your email flow
Quarantine Policy
Quarantine 25% of failing messages
Reject Policy (Full Protection)
Block all unauthorized emails
Step 2: DMARC Implementation Phases
Monitor Phase (p=none)
Collect reports for 2-4 weeks to understand email sources
Quarantine Phase (p=quarantine)
Start with low percentage (10-25%), gradually increase
Reject Phase (p=reject)
Full protection after validating legitimate sources
Step 3: Set Up Report Processing
Configure email addresses to receive DMARC reports and use tools to analyze them.
Aggregate Reports (rua)
Daily summaries of authentication results
Forensic Reports (ruf)
Individual failure samples (use carefully)
Legitimate Emails Being Blocked
Authorized emails are failing DMARC authentication and being rejected.
Solution: Review DMARC reports, fix SPF/DKIM issues, consider relaxed alignment, or add missing email sources.
High Failure Rates
Many legitimate emails are failing DMARC alignment checks.
Solution: Check for forwarding issues, third-party services, or mailing list configurations that break alignment.
No DMARC Reports
Not receiving expected DMARC aggregate or forensic reports.
Solution: Verify report email addresses, check spam folders, ensure proper DNS record format.
Subdomain Issues
Subdomains are not properly covered by DMARC policy.
Solution: Use 'sp=' tag for subdomain policy or create specific DMARC records for each subdomain.
DMARC Alignment Modes:
Organizational domain must match (example.com matches mail.example.com)
Exact domain match required (example.com only matches example.com)
Debugging Tools:
DMARC Report Analyzers
Tools to parse and visualize DMARC reports
Email Header Analysis
Check Authentication-Results headers in received emails
DNS Validation
Verify DMARC record syntax and propagation
Test Email Services
Send test emails to check DMARC compliance
What's the difference between SPF, DKIM, and DMARC?
SPF validates sending IP addresses, DKIM verifies message integrity with cryptographic signatures,and DMARC ties them together with policies and reporting. DMARC requires at least one of SPF orDKIM to pass with proper alignment.
Should I start with p=reject for maximum security?
No, always start with p=none to monitor your email flow first. Jumping directly to p=reject canblock legitimate emails from sources you weren't aware of. Follow the gradual implementationapproach: none → quarantine → reject.
How do I handle third-party email services?
Ensure third-party services (like marketing platforms, CRMs, or support systems) are properlyauthenticated with SPF and DKIM. Many services provide specific instructions for DMARC compliance.You may need to add their IPs to SPF or configure DKIM signing.
What does the pct= tag do?
The pct= tag specifies what percentage of failing messages should have the policy applied. Forexample, pct=25 means only 25% of failing messages will be quarantined or rejected, while 75% willbe delivered normally. This allows gradual policy enforcement.
Do I need DMARC for subdomains?
Subdomains inherit the parent domain's DMARC policy by default. However, if subdomains send email,it's recommended to either set a specific subdomain policy using the sp= tag or create dedicatedDMARC records for each subdomain.
How often should I review DMARC reports?
Review DMARC reports weekly during initial implementation and monthly once stable. Pay attentionto new failure sources, changes in volume, and any legitimate services that might be failingauthentication. Set up automated alerts for significant changes.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.