DMARC record checker and generator

Check a domain's DMARC record and what each setting means, or build a new record below.

For example example.com. You can paste a web address or email address.

Enter a domain to check its DMARC record.

Lookups run in your browser using Cloudflare public DNS; the domains you check are not sent to ZeroDMARC.

Build a DMARC record

Choose your settings and the record updates as you go. It is checked with the same rules as the checker above.

Policy (p)

What receivers should do with mail that fails DMARC.

Separate several addresses with commas.

Few receivers send these, and they can contain personal data.

Failure report options (fo)

Only used when you set a ruf address.

Your record

What is DMARC?

DMARC (RFC 7489) tells receiving mail servers what to do with email that claims to come from your domain but fails authentication, and where to send reports about it. A message passes DMARC when SPF or DKIM passes for a domain that matches, or aligns with, the From address people see.

The record is a TXT record at _dmarc. followed by your domain, for example v=DMARC1; p=none; rua=mailto:[email protected]. The policy is one of none (monitor only), quarantine (treat as suspicious) or reject (refuse).

Most domains start at p=none, use the aggregate reports to find and fix every legitimate sender, then move to quarantine and reject. Going straight to reject without reports risks blocking your own invoices, newsletters or helpdesk mail.

Also check the domain's SPF record.

Questions

Which DMARC policy should I start with?

Start with p=none and a rua address. Nothing about delivery changes, but receivers start sending you aggregate reports. Use them to find every service that sends email as your domain and fix its SPF and DKIM. Then move to p=quarantine and finally p=reject.

What are rua and ruf?

rua is where receivers send aggregate reports: a daily summary of how much mail they saw from your domain, from which servers, and whether it passed SPF, DKIM and DMARC. ruf asks for failure reports about individual messages. Few receivers send failure reports, and those that do may include personal data.

Why does a report address on another domain need authorising?

To stop anyone sending floods of reports to an address that did not ask for them, RFC 7489 says receivers only send reports to another domain if it publishes a TXT record at yourdomain._report._dmarc.theirdomain. Reporting services normally publish it for you when you add your domain.

Do subdomains need their own DMARC record?

No. A subdomain without its own record uses the record of its organisational domain, with the sp policy if one is set, or the p policy otherwise. Publish a record at _dmarc.subdomain only if that subdomain needs a different policy.

Does ZeroDMARC see the domains I check?

No. The check runs in your browser and asks Cloudflare public DNS (cloudflare-dns.com) directly. ZeroDMARC does not receive or store the domains you check. The generator runs entirely in your browser too.