DomainCanary Start free

DMARC record checker

Look up the DMARC record published on any domain to verify policy enforcement, alignment rules, and daily aggregate reporting.

In a DMARC record, you set what happens to mail that fails authentication and where reports go. You publish it as a TXT record at _dmarc.yourdomain.com. Receiving servers use it to check that SPF or DKIM passed for the domain in your visible From address. Use our DMARC record generator if you need to create a new record.

This lookup only shows what you published in DNS. Your DMARC reports show which of your real senders pass, and we read them to decide when each step toward p=reject is safe.

DMARC enforcement with automatic rollback

Get your domain to p=reject without blocking your own mail

We read your DMARC reports and email you each step once they show it's safe. You approve every step. When a sender you marked as yours sends enough mail to measure and a step starts blocking it, we put the previous policy back.

  1. p=nonereports only
  2. p=quarantineyou approve
  3. p=rejectyou approve

Rollback needs hosted DMARC, on the Starter plan and up. You can try it free for 30 days with no card. Rollback works in the days after each step, and it can't bring back mail a receiver already refused. How rollback works

Create your account

Continue with Google

or

Free for your first domain · No card · Per-source totals kept for life

MSPs can group domains by client.

Questions

What do the p= and rua= tags do in a DMARC record?

In p=, you set what happens to mail that fails authentication. With none it's delivered, with quarantine it goes to spam, and with reject it's refused. In rua=, you give the address for your daily XML aggregate reports.

How should you roll out a DMARC policy safely?

Start at p=none to collect aggregate reports and inventory your senders. Once you configure SPF and DKIM for every service, switch to p=quarantine so failed mail drops into spam. Move to p=reject only when you know all legitimate mail passes. Follow our guide to DMARC setup.

Why can moving to p=reject too early break delivery?

At p=reject, receiving servers refuse every message that fails authentication under your domain. If your billing tool, helpdesk or marketing service isn't set up for SPF or DKIM yet, its mail is refused too. Before you move to reject, check your reports with our guide on how to read a DMARC aggregate report.

Why does DMARC fail even when SPF and DKIM pass?

DMARC requires identifier alignment. The domain in your visible From header must match the envelope Return-Path for SPF or the d= tag for DKIM. Third-party platforms often sign with their own shared domains by default. Check our DMARC alignment guide and test your senders with our SPF checker.

What are the np= and psd= tags in DMARC?

The np= tag sets the policy for mail that fails DMARC from subdomains that don't exist in DNS. The psd=y tag marks your domain as a public suffix, like co.uk, so receivers use a base domain one level below it. Relaxed alignment means your From address and SPF or DKIM share that base domain.

The other tools

SPF checkerFree, no signup. DKIM checkerFree, no signup. SPF, DKIM and DMARC checkerFree, no signup. DMARC report analyzerFree, no signup. Paste the XML. SPF record generatorFree, no signup. Merges, never replaces. DMARC record generatorFree, no signup. Keeps your existing tags. SPF change pre-flightFree, no signup. Diff a record before you publish it. Email header analyzerFree, no signup. Paste the headers of one message.