Security & SEO

    DMARC record check

    Explains how to read a DMARC record, assess SPF and DKIM alignment, and make a staged policy decision without treating a DNS record as proof of mail delivery.

    Updated 2026-07-10
    2 min read
    dmarc
    email
    deliverability

    Quick answer#

    DMARC is a DNS policy at _dmarc.yourdomain.com. It tells receiving mail systems what to do when a message fails DMARC and where aggregate reports may be sent. A record check can assess syntax and the published policy; it cannot prove that every sending service is aligned or that a provider will deliver a particular message.

    What to review#

  1. v=DMARC1 and valid tag syntax
  2. The requested policy: p=none, quarantine, or reject
  3. Aggregate-report destinations in rua= and any required external-destination authorisation
  4. SPF and DKIM alignment with the visible From domain (aspf and adkim)
  5. The optional subdomain policy, sp=

    6. Use the result carefully#

    A p=none policy is commonly used to observe traffic while a sender inventory is being built; it is not, by itself, a configuration error. Likewise, an rua address is useful only when its reports are collected and reviewed. Check the current requirements of each mailbox provider you send to, because bulk-sender rules and thresholds can change.

    A staged remediation path#

  6. Inventory every service that sends mail using the domain, including marketing, support and transactional providers.
  7. Publish or correct SPF and DKIM for each authorised sender, then inspect aggregate reports for alignment failures.
  8. Choose a DMARC policy that fits the evidence and your organisation's risk tolerance; increase enforcement only after testing legitimate traffic.
  9. Retain a rollback path and monitor reports after each policy change.

    10. FAQ#

    Does DMARC require both SPF and DKIM to pass?#

    No. DMARC can pass when either SPF or DKIM passes and that mechanism aligns with the visible From domain.

    What is a good rua address?#

    Use an address or reporting service that you control and actively monitor. If it is hosted on another domain, follow the DMARC external-reporting authorisation rules before relying on it.

    Related#

  10. SPF record check
  11. DKIM record check
  12. DNS MX record check
    13. Was this article helpful?

    Previous

    DKIM record check

    Next

    Blacklist & reputation check

    Related Articles

    SPF record check

    Parses your SPF record, counts DNS lookups (10 max), and warns before you hit the RFC 7208 limit that silently breaks deliverability.

    DKIM record check

    Verifies DKIM selector records exist and use ≥1024-bit keys — the invisible half of email deliverability that most teams forget.

    DNS MX record check

    Monitors MX records so a fat-fingered mail edit or expired provider does not silently break customer email.

    Certificate Transparency Monitoring

    Monitor SSL certificate issuance and detect unauthorized certificates.

    Back to Help Center