How to Check DMARC for All Your Client Domains at Once

Paste all your client domains into the bulk DMARC checker and filter by policy. Each row shows whether the domain has a DMARC record, its policy (none, quarantine or reject), the subdomain policy, where aggregate reports go and the alignment settings. You see at a glance which clients have no DMARC, which are only monitoring, and which are at enforcement.

Check DMARC on a list of domains →

Check them in bulk

1. Open the bulk DMARC checker.
2. Paste the domains, one per line: up to 100 a run, or 500 after a free Google sign-in. Email addresses and URLs work too; the domain is taken from each.
3. Press Check DMARC.
4. Read each row: Reject, Quarantine, Monitoring only, Partly enforced, Broken or No DMARC, with the tags behind it.
5. Filter by policy, for example every domain on Monitoring only, and download the CSV for your client report.

Do it by hand

printf "google.com\ngithub.com\ndebian.org\nshopify.com\nneverssl.com\ntest.com\n" > clients.txt

while read -r d; do
  rec=$(dig +short txt "_dmarc.$d" | tr -d '"' | grep '^v=DMARC1')
  p=$(echo "$rec" | sed -n 's/.*[; ]p=\([a-z]*\).*/\1/p')
  echo "$d,${p:-NO DMARC}"
done < clients.txt
# google.com,reject
# github.com,quarantine
# debian.org,none
# shopify.com,reject
# neverssl.com,NO DMARC
# test.com,NO DMARC

We ran this on 9 November 2026. Two rows are worth a closer look:

• shopify.com: dig +short txt _dmarc.shopify.com first prints dmarcreject.shopify.com., because the _dmarc name is a CNAME. The record it points to says p=reject. Many companies manage DMARC centrally this way.
• test.com: there is a TXT record at _dmarc.test.com, but it doesn't start with v=DMARC1, so receivers discard it. That's why the loop keeps only lines starting with v=DMARC1.

The sed pattern looks for p= after a semicolon or space, so it doesn't mistake sp=reject for the main policy. The loop doesn't do what receivers do for a subdomain with no record of its own: RFC 9989, section 4.10 tells them to walk up the DNS tree to the parent's record. The bulk checker does that walk and marks the row as inherited.

Sort the results into three piles

• No DMARC. No record, a record that doesn't start with v=DMARC1, or two records at the same name. RFC 9989 tells receivers to discard all of them when more than one is returned. These clients come first. Google's sender guidelines require bulk senders to publish DMARC.
• p=none. Reports only. The same Google page says the policy can be set to none, so this meets the minimum, but spoofed mail is still delivered. Check that rua= is set, or nobody is reading the reports.
• Quarantine or reject. At enforcement. Check sp= too: a client can be at reject on the main domain while subdomains sit at none.

What changed in May 2026

RFC 9989 replaced RFC 7489 as the DMARC standard. Three changes matter when you read client records:

• pct= is gone. Appendix A.6 explains that values other than 0 and 100 weren't applied consistently. Records with pct= still work with receivers that read it, but don't plan a rollout around it.
• t=y is the new test flag. It asks receivers to apply one level below the stated policy, so p=reject; t=y is treated as quarantine.
• np= covers subdomains that don't exist. It sets a policy for made-up names like invoice.client.com that spammers invent.

For moving a client from none to enforcement, see DMARC from none to reject. For reading the reports that come back, see how to read DMARC aggregate reports.

Next step: check the lists you send for clients

DMARC protects a client's domain from spoofing. It doesn't stop the bounces from dead addresses on the lists you send for them, which hurt the same reputation. Upload each list at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: check a domain's DMARC record, how agencies report list verification to clients.