All posts

How to Check a Domain's DMARC Record (and Read the Policy)

··2 min read

A domain's DMARC record is a single TXT record at _dmarc. in front of the domain, and its p= tag is the policy. Enter the domain in the DMARC checker: it reads the raw record, explains each tag (p, sp, pct, rua, adkim, aspf) and tells you plainly whether the policy blocks spoofed mail or only reports on it.

Check a domain's DMARC record →

Check DMARC with the tool

  1. Open the DMARC checker.
  2. Enter the domain, such as example.com. Don't add _dmarc yourself; the tool looks in the right place.
  3. Read the policy line first: none, quarantine or reject.
  4. Read the tags under it, especially sp= (the subdomain policy) and rua= (where aggregate reports go).

Check it by hand

dig +short txt _dmarc.google.com
# "v=DMARC1; p=reject; rua=mailto:[email protected]"

dig +short txt _dmarc.github.com
# "v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1"

nslookup -type=txt _dmarc.google.com
# _dmarc.google.com	text = "v=DMARC1; p=reject; rua=mailto:[email protected]"

We ran these on 8 November 2026. GitHub's record shows the difference between p= and sp=: mail from github.com that fails DMARC is quarantined, mail from its subdomains is rejected.

dig +short txt _dmarc.docs.github.com returned nothing, which is normal. RFC 7489, section 6.6.3 tells receivers to fall back to the organizational domain's record when the exact domain has none. The same section says that if the set holds more than one DMARC record, or none, DMARC processing isn't applied.

How to read the result

  • p=none: reports only. Failing mail is delivered. Google's sender guidelines require bulk senders to publish DMARC and say the policy can be set to none, so many domains stop here.
  • p=quarantine: failing mail is treated as suspicious, usually spam folder.
  • p=reject: failing mail is refused.
  • pct=: the share of failing mail the policy applies to. Under 100 means a partial rollout.
  • rua=: where daily aggregate reports go. Without it you get no reports.
  • Nothing found: no DMARC at all, or the record was published under the wrong name. Check the host is _dmarc, not _dmarc.example.com.example.com.

For working records to copy, see DMARC record examples. For the move from none to enforcement, see DMARC from none to reject.

Next step: check the addresses you send to

DMARC protects your domain; it doesn't stop bounces from dead addresses on your list, which hurt the same sending reputation. Upload the list at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: SPF, DKIM and DMARC explained, look up a domain's TXT records.

Common questions

How do I check if a domain has DMARC?

Enter the domain in the DMARC checker, or run dig +short txt _dmarc.example.com. If nothing starting with v=DMARC1 comes back, the domain has no DMARC record.

What does p=none mean in a DMARC record?

Monitoring only. Receivers deliver failing mail as normal and send reports to the rua address. It meets Google's bulk-sender requirement but blocks nothing.

Why does my subdomain show no DMARC record?

Most subdomains don't have one. Receivers then look up the organizational domain's record and apply its sp= policy, or p= if there is no sp=.

Can a domain have two DMARC records?

It shouldn't. Under RFC 7489, if more than one record is found, DMARC isn't applied at all. Merge them into one.

Check your list before you send

Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.