How the DMARC check works
Our server asks Cloudflare's public resolver for the TXT records at _dmarc.<domain> and picks the one that starts with v=DMARC1. When a subdomain has none, it asks its parent domains, because receivers then use the parent's policy. For report addresses at another domain it looks up the record that domain must publish to accept the reports. It never contacts a mail server, and each tag is read by the rules of RFC 7489.
A receiver checks DMARC for every message: it passes when SPF passes for a bounce address in the same domain as the From line, or when a DKIM signature from that domain verifies (that match is called alignment). When both fail, the receiver applies p: none delivers, quarantine sends to spam, reject refuses. Either way it sends a daily summary to the rua address.
The safe path is to publish p=none with a rua address, read the reports for a few weeks until every service that sends as you passes, then move to quarantine and finally reject. The checker suggests the next record on that path.
DMARC tags
The tags a DMARC record can hold, separated by semicolons. Only v and p are required.
| Tag | What it sets | Default |
|---|---|---|
v | The version. Always DMARC1, and always first. | — |
p | The policy for mail that fails: none, quarantine or reject. | required |
sp | The policy for subdomains, when it should differ from p. | same as p |
pct | The share of failing mail the policy applies to, from 0 to 100. | 100 |
rua | Where daily aggregate reports go: one or more mailto: addresses, separated by commas. | none |
ruf | Where reports on single failing messages go. Few receivers send them. | none |
adkim | DKIM alignment: r (relaxed, subdomains match) or s (strict, exact domain). | r |
aspf | SPF alignment: r (relaxed) or s (strict). | r |
fo | When failure reports are sent: 0 both checks fail, 1 either fails, d DKIM fails, s SPF fails. | 0 |
ri | How often aggregate reports are asked for, in seconds. | 86400 |
Example
example.com publishes at _dmarc.example.com: "v=DMARC1; p=quarantine; sp=reject; rua=mailto:[email protected]; adkim=s". A message with From: example.com that fails both checks goes to the spam folder; one from news.example.com that fails is refused, because sp=reject. With adkim=s, a DKIM signature by mail.example.com does not count for example.com, but SPF stays relaxed, so a bounce address at bounce.example.com still aligns. Every day, receivers mail a summary to [email protected]. pct is not set, so the policy covers 100% of failing mail.
Questions
How do I check my DMARC record?
Type your domain above and press Check DMARC. The checker reads the TXT record at _dmarc.yourdomain, shows the policy and every tag in plain words, and flags what is missing. To check a record before you publish it, switch to the pasted-record mode; it runs in your browser.
What do p=none, p=quarantine and p=reject mean?
They tell receivers what to do with mail that claims to be from your domain but fails DMARC. none: deliver it as usual and only report. quarantine: put it in the spam folder. reject: refuse it. Start with none to collect reports, then move to quarantine and reject once all your own mail passes.
Do I need DMARC for Gmail, Yahoo and Outlook?
If you send a lot of mail, yes. Since February 2024 Gmail and Yahoo require a DMARC record (p=none is enough) from senders of more than 5,000 messages a day, and Outlook.com has required the same since May 2025. Smaller senders are not required to, but mail with DMARC is trusted more and forged mail in your name is easier to stop.
What are rua and ruf in DMARC?
rua is the address for aggregate reports: a daily XML summary from each receiver, listing which servers sent mail as your domain and whether SPF and DKIM passed. ruf is for failure reports on single messages, which few receivers still send. An address at another domain only gets reports if that domain publishes a record saying it accepts them.
Why does DMARC fail when SPF passes?
Because SPF passed for a different domain. SPF checks the bounce address (Return-Path), which a mail service often sets to its own domain; DMARC needs it to match the domain in the From line. Fix it by setting up a custom bounce domain at the service, or by signing with DKIM for your own domain: one aligned pass is enough.