Understanding DMARC in DNS
DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is a DNS-based standard that helps prevent email spoofing and phishing. It allows domain owners to specify how email servers should handle messages that fail SPF and DKIM authentication checks.
Look Up DMARC Records
Check DMARC records for any domain using our free DNS lookup tool.
Look Up DMARC Records →What Is a DMARC Record?
A DMARC record is a DNS TXT record published under the subdomain _dmarc.example.com. It contains policy instructions and reporting options. For example:
This policy instructs receiving mail servers to quarantine messages that fail authentication, and to send aggregate reports to the specified email address.
DMARC helps improve security and provides visibility into email sources using your domain name.
DMARC Policy Options
The p tag in the record controls how failures are handled. There are three levels:
- none: No action, just monitoring
- quarantine: Deliver to spam or junk folder
- reject: Block the message entirely
How to Look Up a DMARC Record
To check a DMARC record, you can use the following tools:
Windows
Use PowerShell or Command Prompt:
macOS
Open Terminal and run:
Linux
Use dig or nslookup:
or
DMARC Tags and Settings
- v: Always set to
DMARC1 - p: Policy for your main domain
- sp: Policy for subdomains (optional)
- rua: Address for aggregate reports
- ruf: Address for forensic reports (optional)
- aspf and adkim: Set alignment mode to strict (
s) or relaxed (r) - np: Policy for non-existent subdomains (optional)
- psd: Flag marking the domain as a public suffix domain (optional)
- t: Test mode.
t=yasks receivers not to apply your stated policy yet, but to apply the level below it —rejectis treated asquarantine,quarantineasnone. Reports are unaffected.
Tags you may see in older guidance but should not publish: pct, ri and rf were all removed by RFC 9989 in May 2026, which replaced the 2015 specification in RFC 7489. The t tag above covers the part of pct that turned out to be useful in practice.
Why DMARC Matters
- Protects your brand from spoofing attacks
- Improves deliverability of legitimate emails
- Provides insights into who is sending on your behalf
- Works with SPF and DKIM to validate messages
Common Mistakes
- Publishing a DMARC record without valid SPF or DKIM
- Using incorrect syntax or missing semicolons
- Failing to monitor reports after publishing a policy
- Setting
p=rejecttoo early without testing
Example Full Record
This policy tells mail servers to reject unauthenticated mail for both the main domain and subdomains, enforces strict alignment on SPF and DKIM, and requests aggregate reports at [email protected].
Note what it does not set: a reporting interval. There is no longer a tag for one. RFC 9989 removed ri — listed in its Appendix C.5.2 as the "Tag specifying requested interval between aggregate reports" — along with pct and rf. Cadence is the receiver's call. RFC 9990 says reporting periods "SHOULD NOT overlap" and that typically "the reporting period will encompass a single UTC day, beginning at 0000UTC" — so roughly daily is what you should expect in practice, but the record itself is not asking for it. An earlier version of this page described this record as requesting daily reports; that was wrong on both counts and has been corrected.
Summary
DMARC is a powerful tool for protecting your email identity. It prevents bad actors from impersonating your domain and gives you visibility into how your domain is used across the internet. Whether you're running a business or managing your personal domain, publishing and monitoring a DMARC record is a smart move for better email security.
Share this article
Manage Your Domain Portfolio in One Place
DNSai Domain Manager — track DNS records, WHOIS expirations, and SPF, DKIM and DMARC status for every domain you own, from one dashboard. Built for teams sitting on dozens or thousands of domains across brands and acquisitions.
Learn More about DNSai Domain ManagerStart your free account — app.dnsai.com