DMARC Record Checker
Parse a DMARC record and get a straight answer about what protection it actually provides.
About this tool
Parses a DMARC record, explains every tag, and says plainly what the policy does to mail that fails.
**`p=none` provides no protection.** It is the right place to start, because it turns on reporting and lets you find every service that sends as your domain before you break one of them. But a domain that has been on `p=none` for three years has a record that looks like a policy and is not one — and that is by far the commonest state of DMARC on the web.
**`pct` is easy to misread.** `p=reject; pct=10` rejects one failing message in ten. The record says reject; the behaviour is nearly none. It exists so a policy can be rolled out gradually, and it is routinely left behind.
Alignment mode is the other setting worth understanding, and it is explained per tag below rather than assumed.
Common questions
Does p=none protect my domain?
No. It asks receiving servers to report failures and to take no action on them. It is the correct first step and a poor final one — the reports exist so you can move to quarantine and then reject.
How do I move from none to reject safely?
Read the aggregate reports until you recognise every source sending as you, then move to quarantine, then to reject. Use pct to ramp each step if the volume makes you nervous. The whole process usually takes a few weeks.
What is alignment?
DMARC requires the visible From domain to match the domain SPF or DKIM authenticated. Relaxed alignment accepts a subdomain; strict requires an exact match. Strict alignment breaks most third-party senders, which is why relaxed is the default.
Do I need a DMARC record?
Google and Yahoo have required one for bulk senders since 2024, and without it your mail is more likely to be filtered. Even at p=none, the reports tell you who is sending as your domain — which is usually more services than you expected.