Check a DMARC record

Enter a domain. The DMARC checker reads _dmarc.your-domain.com, validates the syntax and rates how well the policy protects your domain against forged email.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together into a policy: it defines what a receiver should do with a message that passes neither SPF nor DKIM, and where to send reports about it. The record lives as a TXT record at _dmarc.your-domain.com.

Without DMARC anyone can send a message with your domain as the visible sender. SPF and DKIM alone do not prevent that, because they verify the technical sender, not the address the recipient sees. DMARC closes exactly that gap.

The important tags

A DMARC record consists of tag-value pairs separated by semicolons:

  • v=DMARC1: version, must be the first tag.
  • p=none | quarantine | reject: the policy. none means monitor only, quarantine sends failing mail to spam, reject refuses it.
  • sp=: policy for subdomains if it should differ from p.
  • pct=: percentage of messages the policy applies to. Useful for a gradual rollout, should end up at 100.
  • rua=mailto:...: address for aggregate reports. Without rua you get no feedback about who is sending on behalf of the domain.
  • ruf=mailto:...: address for forensic reports. No longer supported by many receivers.
  • adkim= and aspf=: alignment mode for DKIM and SPF, r (relaxed) or s (strict).

From p=none to p=reject

The safe path has three stages. First p=none with an rua address, collecting reports for four to eight weeks to find every legitimate sender: newsletter tool, CRM, invoicing system, printers, website forms. Then p=quarantine, ideally starting with pct=25, while continuing to watch the reports. Finally p=reject with pct=100.

The most common mistake is staying at p=none. The policy then offers no protection even though a DMARC record technically exists. The checker flags this as a warning.

v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@example.com; adkim=s; aspf=s

Common mistakes

What the checker detects:

  • No record at _dmarc: the domain is unprotected.
  • Multiple records: receivers then ignore all of them.
  • p missing or with an invalid value.
  • rua address without mailto: or with a typo.
  • pct below 100 in permanent operation.
  • Subdomain policy weaker than the main policy: attackers move to subdomains.

Monitor DMARC continuously

A policy accidentally weakened from p=reject to p=none goes unnoticed until the first forged invoices are sent in the client's name. DomainWarn detects exactly this change within minutes and reports it as critical.

Frequently asked questions

Do I need DMARC if I have SPF and DKIM?
Yes. SPF and DKIM verify technical senders; DMARC additionally checks that they align with the visible sender address and defines what happens on failure.
What does p=none mean?
Monitor only. Receivers treat failures no differently than usual but send reports to the rua address. Sensible as a starting point, not as a permanent state.
Where should the reports go?
To a mailbox someone actually reads, or to a reporting service. Aggregate reports are XML files and tedious to read without tooling.
How long does the move to p=reject take?
Typically six to twelve weeks: collect reports, fix senders, quarantine, then reject.

Add the DMARC record at IONOS, STRATO, Hetzner, Cloudflare and others

The path to the DNS editor differs by host. For the common providers this shows where you create the DMARC record and what to watch out for.

DMARC record at IONOS

  1. Sign in to the IONOS account and open "Domains & SSL".
  2. Click the gear icon next to the domain and choose "DNS".
  3. Choose "Add record", pick the type (TXT, MX, CNAME) and host name, paste the value, save.
  4. Changes usually apply within minutes; the default TTL is one hour.

Use "@" as the host name for the apex domain; IONOS shows it as the domain name.

DMARC record at STRATO

  1. In the STRATO customer login open "Domains" and then "Domain administration".
  2. Choose "manage" next to the domain and switch to the "DNS settings" tab.
  3. STRATO separates by type: "TXT and CNAME records" for SPF, DKIM, DMARC and verifications, "MX records" for mail delivery.
  4. Enter the value and save; propagation can take up to an hour.

For subdomain records such as _dmarc or selector._domainkey put the prefix into the "Subdomain" field, not into the value.

DMARC record at Hetzner

  1. Open the Hetzner DNS Console (dns.hetzner.com) and select the zone of the domain.
  2. Choose "Add record", enter type, name and value, lower the TTL if needed.
  3. Save; the Hetzner name servers serve the record immediately.

DMARC record at ALL-INKL

  1. Sign in to KAS (the customer administration system) and open "Domain".
  2. Click "edit" next to the domain and then "DNS settings".
  3. "Create new DNS record", enter name (empty for the apex), type and value, save.
  4. ALL-INKL applies changes within minutes.

DMARC record at Cloudflare

  1. In the Cloudflare dashboard open the domain and choose "DNS" → "Records".
  2. Choose "Add record" and enter type, name and content.
  3. For MX, TXT and mail-related CNAME records keep the proxy status on "DNS only"; the orange cloud belongs to web records only.
  4. Save; Cloudflare propagates instantly.

DMARC record at netcup

  1. In the netcup Customer Control Panel (CCP) open "Domains" and select the domain.
  2. Switch to the "DNS" tab and choose "Add new record".
  3. Enter host (@ for the apex), type and destination, then "Save DNS records".

DMARC record at united-domains

  1. In the united-domains portfolio click the domain and open "DNS settings".
  2. Under "Custom DNS records" choose the type, enter subdomain and value.
  3. Save; propagation takes a few minutes.

DMARC record at checkdomain

  1. In the checkdomain customer area open "Domains" and select the domain.
  2. Open "DNS settings" and create a new record with type, name and value.
  3. Save.

DMARC record at domainfactory

  1. In the domainfactory customer menu open "Domains" and select the domain.
  2. Open "Name server settings" and create a new record.
  3. Enter type, host name and value, save.

DMARC record at Alfahosting

  1. In the Alfahosting customer center open the domain and choose "DNS management".
  2. Create a new record with type, name and value, save.

DMARC record at webgo

  1. In the webgo customer portal open "Domains" and choose "DNS management" next to the domain.
  2. Create a record with type, name and value, save.

DMARC record at 1blu

  1. In the 1blu customer service area open "Domains" and choose "DNS settings" next to the domain.
  2. Create a record with type, name and value, save.

DMARC record at Host Europe

  1. In KIS (the customer information system) open "Domain services" and then "Domain administration".
  2. Choose "Name server / DNS" next to the domain and create the record with type, name and value.
  3. Save.

DMARC record at Mittwald

  1. In mStudio open the project and select the domain under "Domains".
  2. Open "DNS", edit or create the record, save.

DMARC record at GoDaddy

  1. At GoDaddy open "My Products" and choose "DNS" next to the domain.
  2. Choose "Add", enter type, name and value, save.

DMARC record at Hostinger

  1. In hPanel open "Domains" and choose "DNS / Nameservers" next to the domain.
  2. In the DNS zone editor create the record with type, name and value.

DMARC record at Amazon Route 53

  1. In the AWS console open Route 53, "Hosted zones" and select the zone.
  2. Choose "Create record", enter name, type and value, set the TTL, "Create records".

DMARC record at Google Cloud DNS

  1. In the Google Cloud console open "Cloud DNS" and select the zone.
  2. "Add record set", enter name, type and value, create.

DMARC record at Azure DNS

  1. In the Azure portal open "DNS zones" and select the zone.
  2. Add a "Record set", enter name, type and value, OK.

DMARC record at OVHcloud

  1. In the OVHcloud control panel open "Web Cloud" → "Domain names" and the domain.
  2. Tab "DNS zone", "Add an entry", choose the type, enter subdomain and value, confirm.

DMARC record at DigitalOcean

  1. In the DigitalOcean dashboard open "Networking" → "Domains" and select the domain.
  2. Choose the type, enter host name and value, "Create Record".

DMARC record at Squarespace

  1. At Squarespace open "Domains", select the domain and open "DNS settings".
  2. Under "Custom records" create the record with type, host and data.

DMARC record at Wix

  1. In the Wix account open "Domains" and choose "Manage DNS records" next to the domain.
  2. Under the matching type choose "Add record", enter host name and value, save.

DMARC record at Shopify

  1. In the Shopify admin open "Settings" → "Domains" and select the domain.
  2. Open "DNS settings", "Add custom record", enter type, name and value, confirm.

DMARC record at INWX

  1. At INWX open "Nameserver" and select the domain.
  2. "Add record", enter type, name and value, save.

DMARC record at dogado

  1. In the dogado customer area open the domain and choose "DNS".
  2. Create the record with type, name and value, save.

DMARC record at Variomedia

  1. In the Variomedia customer menu open the domain and choose "DNS settings".
  2. Create the record with type, name and value, save.

DMARC record at Namecheap

  1. At Namecheap open "Domain List", "Manage" and the "Advanced DNS" tab.
  2. "Add New Record", enter type, host and value, save.

DMARC record at Gandi

  1. At Gandi open the domain and choose "DNS records".
  2. "Add a record", enter type, name and value, create.

DMARC record at Vercel

  1. In the Vercel dashboard open "Domains" and select the domain.
  2. Under "DNS Records" enter type, name and value, "Add".

Guides for this tool

More tools

Free tool

SPF Checker

Free SPF record check and lookup: syntax, includes, the 10 DNS lookup limit and the closing qualifier. Shows whether your domain blocks forged senders.

Open tool →
Free tool

DNS Checker

Free DNS lookup straight from the authoritative name server: A, AAAA, CNAME, MX, TXT, NS and CAA records at a glance. No sign-up, every record explained.

Open tool →
Free tool

MX Checker

Free MX lookup: which mail servers receive for a domain, do they resolve, is the priority right? Detects missing and unreachable mail servers.

Open tool →
Free tool

SSL Checker

Free SSL certificate check: expiry date, issuer, chain, host name, alternative names and TLS version. Detects expired, self-signed and mismatched certificates.

Open tool →
Free tool

HTTP Header Checker

Free HTTP header check: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy with recommendations.

Open tool →
Free tool

Redirect Checker

Free 301 redirect check: every hop with status code and response time, from http to https, from www to non-www. Detects redirect chains, loops and 302s.

Open tool →
Free tool

DKIM Checker

Free DKIM record check and lookup: selector, key type, key length, syntax and revoked keys. Leave the selector empty to try common selectors automatically.

Open tool →
Free tool

DNSSEC Checker

Free DNSSEC test: DS record, resolver validation and broken signature chains. Shows whether validating resolvers like Google or Cloudflare reach your domain.

Open tool →
Free tool

MTA-STS Checker

Free MTA-STS check: DNS record, policy file, mode, max_age and whether your MX servers are covered. Shows whether inbound mail enforces TLS.

Open tool →
Free tool

TLS-RPT Checker

Free TLS-RPT record check: syntax, reporting addresses (rua) and common errors such as a missing record. Shows whether you get reports on TLS failures.

Open tool →
Free tool

BIMI Checker

Free BIMI record check: syntax, logo URL, SVG Tiny PS, VMC certificate and the DMARC prerequisite. Shows why your logo does not appear in Gmail.

Open tool →
Free tool

Blacklist Check

Free IP blacklist and domain blacklist check: mail server IPs, website IP and domain against Spamhaus, Spamcop, Barracuda, PSBL and SURBL. With delisting links.

Open tool →
Free tool

Domain Checker

Free domain check: expiry date, registrar, EPP status, transfer lock and name servers straight from the registry via RDAP. Warns about expiry and holds.

Open tool →