Record on the wrong host
It must sit at _dmarc.yourdomain, not on the domain itself.
Tools · 30 seconds
DMARC checker
Look up a domain’s DMARC record, see what each tag means and whether the policy protects you.
Runs in your browser · public DNS records only · nothing stored
What DMARC does
DMARC is a TXT record at _dmarc.yourdomain. It tells inbox providers what to do with email that claims to be from you but fails SPF and DKIM: deliver it (p=none), send it to spam (p=quarantine) or block it (p=reject).
It also asks providers to send you daily reports, so you can see every service that sends email as your domain, including ones you forgot about.
Move from p=none to p=reject safely
- Week 0Publish p=none with a rua address. Nothing is blocked.
- Weeks 1 to 4Read the reports. Add every legitimate sender to SPF and switch on DKIM in each tool.
- ThenMove to p=quarantine, optionally with pct=25 first, then 100.
- FinallyMove to p=reject when reports show only your own tools passing.
DMARC tags
| Tag | Example | Meaning |
|---|---|---|
v | v=DMARC1 | Version. Always first. |
p | p=quarantine | Policy: none, quarantine or reject. Required. |
rua | rua=mailto:[email protected] | Where daily aggregate reports go. |
sp | sp=reject | Policy for subdomains. |
pct | pct=50 | Share of failing email the policy applies to. |
adkim / aspf | adkim=s | Alignment: r (relaxed, default) or s (strict). |
ruf | ruf=mailto:… | Failure reports. Few providers send them. |
Common DMARC errors and fixes
Two DMARC records
Providers ignore DMARC. Keep one.
No p= tag
The record is invalid. Add p=none to start.
Reports to another domain without permission
The receiving domain must publish yourdomain._report._dmarc.theirdomain. Reporting services do this when you add your domain.
p=none for months
Monitoring only. Plan the move to quarantine.
Gmail and Yahoo sender rules
What inbox providers require since February 2024
Bulk senders send about 5,000 or more emails a day to Gmail. Cold email teams reach that quickly across mailboxes, so treat the bulk rules as the standard.
Source: Google email sender guidelines
| Rule | Who | Requirement |
|---|---|---|
| SPF or DKIM | All senders | Required |
| SPF and DKIM | Bulk senders | Required |
| DMARC, p=none or stronger | Bulk senders | Required |
| From domain aligned with SPF or DKIM | Bulk senders | Required |
| One-click unsubscribe | Bulk senders, marketing email | Required |
| Spam complaint rate | All senders | Below 0.3 percent |
Questions people ask
How do I check my DMARC record?
Enter your domain above. The checker reads the TXT record at _dmarc.yourdomain, explains each tag and checks the policy and report addresses.
Which DMARC policy should I use?
Start with p=none and a report address. After two to four weeks of clean reports move to p=quarantine, then p=reject.
Is p=none enough for Gmail and Yahoo?
It meets the minimum Google and Yahoo set for bulk senders. It does not stop anyone from sending email that pretends to be you.
What are DMARC reports?
Daily XML files from providers such as Google and Microsoft, listing which servers sent email as your domain and whether they passed. A DMARC reporting service turns them into readable charts.
Is my domain stored?
No. The check runs in your browser. Your browser asks Cloudflare’s public DNS service (or Google’s, as a fallback) for the domain’s public records, the same records every mail server reads. RevOps Lab does not receive or store the domain or the result.