DMARC Lookup
Parse the DMARC policy at _dmarc.<domain>.
Enter a value above to run DMARC Lookup
e.g. example.com
Quick answer
DMARC Lookup reads the TXT record at _dmarc.<domain> and shows what a domain tells receivers to do with mail that fails SPF and DKIM. Check the p= tag: none only monitors, quarantine sends failing mail to spam, and reject blocks it outright.
DMARC Lookup fetches and parses the TXT record published at _dmarc.<domain>, the policy that tells receiving mail servers what to do when a message fails SPF and DKIM alignment. The tool reads each tag in plain language: the enforcement policy (p=), the subdomain policy (sp=), the aggregate report address (rua=), and the percentage of mail the policy applies to (pct=).
If you send email from your domain, DMARC is what actually protects you from spoofing. Checking the record confirms it exists, is syntactically valid, and enforces the level of protection you intended.
How it works
DMARC lives in a single TXT record at the fixed hostname _dmarc.<domain>, not at the domain root. The tool queries that name and looks for a string beginning with v=DMARC1. It then splits the record into semicolon-separated tags and displays each one. A domain has at most one DMARC record; if none is found, the domain has no published policy and receivers fall back to their own defaults, which usually means no spoofing protection at all.
How to read the results
The key tag is p=: none only monitors and collects reports, quarantine sends failing mail to spam, and reject blocks it outright. rua= is the mailbox that receives daily aggregate XML reports, essential when moving from none to enforcement. sp= sets a separate policy for subdomains, and pct= applies the policy to a fraction of mail during rollout. adkim and aspf control whether alignment is strict (s) or relaxed (r).
Common problems & fixes
A record placed at the root domain instead of _dmarc will never be read; it must be at the _dmarc subdomain. Two DMARC records cause receivers to ignore both, so keep exactly one. Staying at p=none forever gives reporting but no protection; move to quarantine or reject once your reports show all legitimate senders passing. A missing rua= means you get no visibility into who is sending on your behalf.
Frequently asked questions
- Do I need SPF and DKIM before adding DMARC?
- Yes. DMARC works by checking that a message passes SPF or DKIM and that the passing domain aligns with the From address. Without at least one of them configured and aligned, every message fails DMARC. Publish and verify SPF and DKIM first, start DMARC at p=none to gather reports, then tighten the policy.
- What does p=none actually protect against?
- On its own, nothing. p=none is a monitoring mode: it asks receivers to send you reports but tells them to take no action on failures. It is the correct starting point because it lets you see every source sending mail as your domain before you enforce. Real protection begins only when you move to p=quarantine or p=reject.
- Where do the aggregate reports go?
- To the address in the rua= tag, written as a mailto: URI, for example rua=mailto:[email protected]. Receivers send one XML report per day summarizing pass and fail counts per source IP. Most teams point rua= at a dedicated inbox or a DMARC reporting service that parses the XML, since the raw files are hard to read by hand.