How this check works
We look up the TXT record at _dmarc.<domain>. If the domain has no record of its own, we walk up the DNS tree as described in RFC 9989 (published May 2026), which replaced RFC 7489 and its dependence on the Public Suffix List.
The applicable record is parsed tag by tag. We explain the policy for the domain itself (p), for existing subdomains (sp) and for non-existent subdomains (np), and point out tags that were removed in RFC 9989 (pct, rf, ri) but still affect receivers that implement the older specification.
For every report address outside your organizational domain we query the authorization record (<your-domain>._report._dmarc.<report-domain>). Without it, receivers must not send reports there.
Limitations
- A DMARC record alone does not protect a domain. It only works if your legitimate mail passes SPF or DKIM with a domain aligned to the From address — check those too.
- We cannot see which receivers implement RFC 9989 and which still follow RFC 7489; where the two differ, we say so.
- Checked domains are not stored or logged.
Frequently asked questions
Which policy should I start with?
Start with p=none and a rua address so you receive aggregate reports. Use the reports to find every service that sends mail as your domain and make it pass SPF or DKIM with alignment. Then move to p=quarantine and finally p=reject.
What changed in RFC 9989?
DMARC became a Standards Track protocol. Policy discovery now uses a “DNS Tree Walk” instead of the Public Suffix List, the np tag (policy for non-existent subdomains) and psd tag were added, and pct, rf and ri were removed. The t=y testing flag replaces the common pct=0 practice. Existing v=DMARC1 records stay valid.
Do I really need a rua address?
Without rua, receivers send no aggregate reports and you cannot see who sends mail using your domain, or which legitimate streams fail. That makes moving to an enforcing policy guesswork.
Does having a DMARC record mean my domain is protected from spoofing?
Only with p=quarantine or p=reject, and only if receivers can authenticate your real mail. With p=none, failing messages are delivered as usual — the record is for monitoring.
What is alignment?
DMARC passes when SPF or DKIM passes for a domain that matches the From address. In relaxed mode (the default) the organizational domains must match, so mail.example.com aligns with example.com. In strict mode (adkim=s, aspf=s) the domains must be identical.