DMARC record checker and generator
See the DMARC policy receivers apply to a domain or subdomain, check that reports can reach you, and plan a safe path to p=reject.
By using these tools you accept the Terms and the Privacy page.
How the DMARC checker reads your policy
The DMARC checker shows the policy receivers apply to mail that carries your domain in the From address, and its builder writes the record for each step toward p=reject. It is for anyone who runs a domain’s email and wants to stop spoofing without blocking their own mail. Many findings come with a fix.
What the check looks at
- Syntax. Every tag is validated against RFC 9989. Invalid parts are underlined, and obsolete tags (
pct,rf,ri) are flagged. - Records receivers skip. A TXT record that almost reads as DMARC is caught: quotes typed into the DNS dashboard, a leading space, a lower-case
dmarc1or a missing semicolon afterv=DMARC1. So are several DMARC records at one name, which makes receivers discard all of them. - The policy in force.
pfor the domain,spornpfor subdomains, one level softer whilet=yis set. - Report addresses. Each
ruaandrufentry is checked as amailto:address; receivers may ignore other schemes. An authorization record that redirects reports to another host is caught too, because receivers then send no report at all. The first ten report hosts in a record are verified; any beyond that are listed as not checked. - Subdomain gaps. An
spweaker thanpleaves subdomains open to spoofing. Withoutnp, names that don’t exist get thesporppolicy;np=rejectcloses that gap without touching real subdomains.
How the grade is worked out
The grade starts from the policy enforced in practice: reject is an A, quarantine a B and none a D. Test mode counts one level lower, so p=reject; t=y grades as quarantine. An A+ needs full reject, a working aggregate report address and no warnings.
Syntax errors cost an A or B one letter, a weaker subdomain policy caps the grade at B, and an unauthorized report address rules out A+. Two or more records at one name, or a record receivers ignore, is an F. When the lookup fails there is no grade at all: a failed query says nothing about the record.
The tree walk’s lookups run in parallel from your browser, and the whole check stops after 15 seconds. A lookup still unanswered by then is marked as couldn’t check rather than read as a missing record, and Check again asks once more.
Building a record
The Build a record tab writes the TXT record for the rollout stage you pick and dates every step after it, up to full enforcement. Test steps add t=y and pct=0 together: receivers on RFC 9989 read t=y, receivers still on RFC 7489 read pct=0, and both apply one level less while you watch the reports. A failure report address also adds fo=1, which asks for a report whenever SPF or DKIM fails to align. Report addresses must be plain ASCII email addresses; characters a DMARC record can’t carry as they are, such as ! or =, are percent-encoded, and a record longer than one 255-character TXT string gets a note. Check it now runs the checker on the same domain, so you can compare the plan with what it publishes today.
Before you enforce
Enforcing only works once your own mail passes. Run the SPF checker and the DKIM checker for every service that sends as your domain, then open your aggregate reports in the DMARC report reader to find the senders you missed.
Updated · Maintained by Liviu Tanase
Questions
How do I create a DMARC record?
Open Build a record, enter your domain and an aggregate report address, and pick where you are in the rollout. The tool writes the TXT record to publish at _dmarc.yourdomain, as one record that replaces any existing v=DMARC1 record there, and dates every step up to p=reject. Start with p=none, and before you enforce, make sure each service that sends as your domain passes the SPF checker or the DKIM checker.
Is p=none good enough?
Only as a first step. With p=none receivers take no action on mail that fails DMARC, so spoofed mail is still delivered, and the checker grades it D. p=quarantine grades B and p=reject grades A; an A+ also needs a working aggregate report address and no warnings. The email deliverability score gives more points for an enforced policy too.
Why am I not getting DMARC reports?
The check flags the usual causes: no rua tag; a report address outside your Organizational Domain whose domain hasn’t published the _report._dmarc authorization record; an authorization record that redirects reports to another host, which stops them altogether; a URI that isn’t mailto:, which receivers may ignore; and an obsolete !size limit small enough that receivers still on RFC 7489 skip larger reports. Once reports arrive, open them in the DMARC report reader.
What changed in RFC 9989?
RFC 9989 (May 2026) replaced RFC 7489 and moved DMARC to the standards track. The pct tag is gone: t=y now asks receivers to apply one level less than the policy while you test. np= sets a policy for subdomains that don’t exist, psd= marks public suffixes, and the Organizational Domain is found with a DNS tree walk instead of a public suffix list. rf and ri were removed. Reporting moved to RFC 9990 and RFC 9991.
Why does my subdomain show a policy when it has no record?
Receivers that find no record at _dmarc.sub.example.com walk up the DNS tree and use the Organizational Domain’s record, applying its sp tag (or np for names that don’t exist, and p when neither is set). The check shows each name it queried and which record won.
What does “not authorized” mean for a report address?
When rua or ruf points outside your Organizational Domain, the receiving domain has to agree to take the reports by publishing a TXT record starting with v=DMARC1 at yourdomain._report._dmarc.theirdomain (a wildcard works). Without it, receivers must not send reports there. Report services publish this for their customers; your own second domain needs it added by you.
How long should each rollout step take?
There is no fixed timetable. RFC 9989 asks you to read aggregate reports and fix every legitimate sender before enforcing, which can take months for a large organization. The planner’s default of four weeks of monitoring and two-week test phases suits a small setup; lengthen any step that still shows failures from your own senders.
What is the difference between relaxed and strict alignment?
DMARC passes when SPF or DKIM passes for a domain that aligns with the From domain. Relaxed alignment (the default) accepts any domain with the same Organizational Domain, so mail signed by mail.example.com aligns with From: example.com. Strict alignment requires an exact match. Keep relaxed unless you control every sender.
Is anything sent to zerobounce.ai?
No. The lookups run from your browser to Cloudflare and Google DNS-over-HTTPS, and the generator works entirely on the page. What you check isn’t sent to zerobounce.ai, unless it is in a link you open (a shared result, for example), which appears in the request logs described on the privacy page.