DMARC Checker With Fixes to Copy
Enter a domain or an email address. See the record that applies, what each tag does under RFC 9989 (May 2026), what Gmail, Yahoo and Microsoft expect, and copy a corrected record. Free, no sign-up, nothing stored.
Your Domain
Try it: salesforce.com, paypal.com
How to Read Your Result
Four parts, the most urgent first.
- 1
The Verdict
No record, monitoring, quarantine or reject, each with an icon and a word. The bar shows how far your domain is on the way to enforcement.
- 2
What to Fix First
Errors that stop DMARC from working come first, then recommendations, then tips. Each point names its rule and source.
- 3
Gmail, Yahoo and Microsoft
What the three ask of bulk senders and what DNS shows for your domain. Alignment and one-click unsubscribe show only in a sent email, so the result says where to look.
- 4
Your Improved Record
Your valid settings without the removed tags, with the policy you choose. Copy it into a TXT record at _dmarc.
What Is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving mail servers what to do with email that claims to come from your domain but fails authentication: deliver it, put it in spam or refuse it. It also asks them to send you reports, so you see who sends in your name.
- SPF. Lists the servers allowed to send for a domain. It checks the return-path, the address bounces go to, not the From address readers see.
- DKIM. Signs each message. Receivers check the signature with a public key that the signing domain publishes in its DNS.
- DMARC. A TXT record at
_dmarc.yourdomain.com, defined since May 2026 by RFC 9989 (it replaced RFC 7489). It passes when SPF or DKIM passes for a domain that matches the From address.
p=none, Quarantine or Reject?
The policy decides what happens to mail that fails DMARC. Start at none, end at reject.
| Policy | Failing mail | Use it when |
|---|---|---|
| p=none | Delivered as usual; you get reports. | You start, or you add a new sending tool. |
| p=quarantine | Goes to the spam folder. | The reports show your own senders pass. |
| p=reject | The receiving server refuses it. | Only spoofed mail still fails. |
Move to Enforcement Without Losing Mail
Five steps from the first record to reject. The checker tells you which one you are on.
- 1
Publish p=none With a Report Address
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Use a mailbox someone reads, or a DMARC report service. - 2
Read the Reports for Two to Four Weeks
List every service that sends as you: email tool, CRM, help desk, invoicing. Each must pass SPF or DKIM for your domain.
- 3
Fix the Senders
Set up DKIM in each tool, in Account Engagement (Pardot) with the DomainKey record, or move a sender to a subdomain of its own.
- 4
Quarantine, First With t=y
Switch to p=quarantine and add t=y as a safety net while you watch the reports. New in RFC 9989, t=y softens the policy by one step (receivers treat reject as quarantine and quarantine as none) and takes the place of pct, which RFC 9989 removed. Then remove t=y.
- 5
Reject
When only spoofed mail still fails, set p=reject. Add np=reject, so made-up subdomains are refused too.
DMARC Reports
Without reports, every step towards reject is a guess.
Aggregate reports (rua) arrive regularly, usually once a day, from receivers such as Gmail and Yahoo.
Failure reports (ruf) describe single messages that failed; not every receiver sends them. They can contain personal data such as email addresses and subject lines, so send them only to a mailbox or service you have a data processing agreement with (GDPR).
Reports to another domain need that domain’s consent: a TXT record yourdomain.com._report._dmarc.theirdomain.com with v=DMARC1 (RFC 9990 (opens in a new tab), section 4). Report services publish it once you add your domain to your account; the checker tests it for every address.
In an aggregate report
- Which servers sent mail as your domain
- How many messages passed SPF, DKIM and DMARC
- No message content: counts and server addresses only
Gmail, Yahoo and Microsoft Rules
All three ask bulk senders for DMARC at p=none or stricter. Checked on 16 October 2026.
- 5,000Messages a day: where Gmail and Microsoft count you as a bulk sender
- 2 daysYahoo gives you to honour an unsubscribe
- 2048Bits: the DKIM key length Google recommends
| Provider | Since | Applies to | DMARC | Also required |
|---|---|---|---|---|
| Gmail | 1 Feb 2024; stricter enforcement since Nov 2025 | Close to 5,000 or more messages a day to personal Gmail accounts | p=none or stricter; From aligned with SPF or DKIM | SPF and DKIM, one-click unsubscribe, spam rate below 0.3% |
| Yahoo | Feb 2024 | Bulk senders | p=none or stricter, passing; From aligned with SPF or DKIM | SPF and DKIM, one-click unsubscribe honoured within 2 days, spam rate below 0.3% |
| Microsoft Outlook.com | 5 May 2025 | More than 5,000 messages a day to Outlook.com, Hotmail and Live addresses | p=none or stricter; aligned with SPF or DKIM | SPF and DKIM must pass |
Common DMARC Errors
What checkers report, what it means and how to fix it.
- No DMARC record found. Nothing at
_dmarc.or at a parent domain. Fix: Add a TXT record at_dmarc:v=DMARC1; p=none; rua=mailto:… - Multiple DMARC records. Two TXT records at one name start with v=DMARC1. Fix: Merge them into one: receivers discard all of them.
- Record on the wrong host. The record sits on the domain itself. Fix: Move it to the host name
_dmarc. - v=DMARC1 missing or not first. Version missing, misspelled or later in the record. Fix: Start the record with
v=DMARC1, in capitals. - Invalid policy. Often a missing semicolon:
p=none rua=…reads as one value. Fix: Separate every tag with a semicolon. - External destination not authorized. The report domain has not agreed to take your reports. Fix: Add your domain in the report service, or ask it for the
_report._dmarcrecord. - pct below 100. pct was removed in RFC 9989; old and new receivers act differently. Fix: Delete pct; use t=y to test.
- SPF: too many DNS lookups. More than 10 lookups is a permanent SPF error. Fix: Remove includes of services you no longer use.
For Pardot and Marketing Cloud Next
What Salesforce’s own help pages say about DMARC, checked on 16 October 2026.
Account Engagement (Pardot)
Pardot signs with DKIM under the selector
200608: the DomainKey record from Domain Management. Its return-path is a Salesforce bounce domain, so SPF passes without matching your domain. Your DMARC result depends on DKIM: check the key before you move past p=none. Pardot adds the one-click List-Unsubscribe header itself.Marketing Cloud Next
It sends from an authenticated domain: eight CNAME records from Salesforce, three of them 2048-bit DKIM keys with selectors per account (
s1-e360-…). SPF comes with the bounce CNAME. Salesforce activates the domain without DMARC, but Gmail, Yahoo and Microsoft still expect it. Use a subdomain that no other platform sends from, Pardot included.
What a DNS Check Can’t Tell You
The record is half the story. Stuck between p=none and reject? We read the reports with you and fix the senders in Pardot or Marketing Cloud Next.
- Whether Your Mail Passes. Alignment shows in a sent message. In Gmail open one of your emails, choose “Show original” and look for DMARC: PASS.
- Who Spoofs Your Domain. Only the aggregate reports show the servers that send in your name.
- Your Reputation. Spam rate and reputation at Gmail show in Google Postmaster Tools.
- Which Standard a Receiver Follows. Receivers that still follow RFC 7489 may apply pct and find the organizational domain with the public suffix list. For most domains the result is the same.
DMARC Checker FAQ
Short answers to what people ask about DMARC records.
How do I check my DMARC record?
Enter your domain above: the checker reads the TXT record at _dmarc.yourdomain.com and, if there is none, at its parent domains.
On the command line: dig TXT _dmarc.example.com or nslookup -type=TXT _dmarc.example.com.
Is p=none enough?
For Gmail, Yahoo and Microsoft, yes: p=none meets their minimum for bulk senders.
It does not protect your domain, though. Spoofed mail is still delivered, so treat p=none as the start and move on to quarantine and reject.
What is a good DMARC record?
To start: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
The goal: v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com, reached step by step once the reports show that every sender passes.
Can I have more than one DMARC record?
No. If a name holds more than one record that starts with v=DMARC1, receivers discard all of them (RFC 9989, section 4.10).
Put everything into one record; several report addresses go into rua, separated by commas.
How long until a DMARC change takes effect?
As long as the old record’s TTL: resolvers keep an answer until it runs out. The checker shows your record’s TTL in seconds; check again after that.
Does DMARC apply to subdomains?
Yes. A subdomain without its own record takes the policy of its organizational domain: sp if it is set, otherwise p.
np, new in RFC 9989, covers subdomains that don’t exist, which spoofers like to use.
Is pct still valid?
No. RFC 9989 (May 2026) removed pct, rf and ri. Receivers that follow it ignore them; older ones may still apply pct.
To test a stricter policy, use t=y instead.
Do I need DKIM for DMARC?
DMARC passes when SPF or DKIM passes and aligns, so one is enough in principle.
Gmail, Yahoo and Microsoft ask bulk senders for both, and with Pardot only DKIM aligns. Set it up.
Is the domain I check stored?
No. Your browser sends the domain names to our server, which asks a public DNS resolver. Nothing is saved, no domain is logged, and the resolver never sees your IP address.
More Free Tools
We Make Salesforce Marketing Work for You
Talk to a certified consultant, not a salesperson, and leave the first call knowing your next step.