DMARC Record Lookup

DMARC Record Lookup fetches a domain's _dmarc TXT record in real time and explains its policy (p), report addresses (rua/ruf) and alignment (adkim/aspf). Built on top of SPF and DKIM, DMARC is what ultimately blocks email spoofing — the core of protecting your sending domain.

Just enter a domain; _dmarc.<domain> is queried automatically. Whether the policy is none, quarantine or reject makes a big difference to real protection.

Policy (p) levels

• p=none: no blocking, reports only (monitoring). The first step.
• p=quarantine: failing mail is quarantined (e.g. to spam).
• p=reject: failing mail is rejected. Strongest protection.

Key tags

• rua: address (mailto:) to receive aggregate reports.
• pct: percentage of mail the policy applies to (for gradual rollout).
• adkim / aspf: DKIM/SPF alignment mode (r = relaxed, s = strict).

To create a new DMARC record or tighten an existing policy, build a correct TXT value with DMARC Record Generator, and review your domain's overall authentication with Email Deliverability Check.

Full tag reference

Reading a real record

Walking through this record line by line:

v=DMARC1; p=quarantine; sp=reject; pct=50; adkim=s; aspf=r; rua=mailto:dmarc@example.com; ruf=mailto:forensic@example.com; fo=1

• p=quarantine; pct=50 → of the org domain's failing mail, only half (50%) is quarantined; the other half passes through as if p=none. A clear sign of a rollout in progress.
• sp=reject → subdomains are rejected with no exceptions. Subdomains are protected more strictly than the main domain here.
• adkim=s → the DKIM signing domain (d=) must exactly match the From header domain to pass alignment (no subdomain leeway).
• aspf=r → SPF passes alignment at the organizational-domain level (so mail.example.com still aligns with example.com).
• fo=1 → generate a failure report if either SPF or DKIM fails (the default 0 requires both to fail).

Common pitfall

• Trusting the policy alone. Even with p=reject, legitimate mail gets rejected if SPF/DKIM aren't aligned. DMARC doesn't just check whether SPF/DKIM "passed" — it checks that the authenticated domain matches the From header domain.
• Misreading pct as policy strength. pct=50; p=reject doesn't mean "reject 50%". It applies reject to 50% and downgrades the rest to quarantine — not none.
• Sending rua to another domain without authorization. To receive reports at an address on a different domain, that domain needs an external-authorization record such as example.com._report._dmarc.reportdomain TXT "v=DMARC1".