---
title: "DMARC record check — Lemwatch Help"
description: "Explains how to read a DMARC record, assess SPF and DKIM alignment, and make a staged policy decision without treating a DNS record as proof of mail delivery."
canonical: "https://lemwatch.com/help/dmarc-record-check"
source: "https://lemwatch.com"
---

# DMARC record check

> Explains how to read a DMARC record, assess SPF and DKIM alignment, and make a staged policy decision without treating a DNS record as proof of mail delivery.

## Quick answer

 DMARC is a DNS policy at _dmarc.yourdomain.com . It tells receiving mail systems what to do when a message fails DMARC and where aggregate reports may be sent. A record check can assess syntax and the published policy; it cannot prove that every sending service is aligned or that a provider will deliver a particular message.

## What to review

- v=DMARC1 and valid tag syntax

- The requested policy: p=none , quarantine , or reject

- Aggregate-report destinations in rua= and any required external-destination authorisation

- SPF and DKIM alignment with the visible From domain ( aspf and adkim )

- The optional subdomain policy, sp=

## Use the result carefully

 A p=none policy is commonly used to observe traffic while a sender inventory is being built; it is not, by itself, a configuration error. Likewise, an rua address is useful only when its reports are collected and reviewed. Check the current requirements of each mailbox provider you send to, because bulk-sender rules and thresholds can change.

## A staged remediation path

- Inventory every service that sends mail using the domain, including marketing, support and transactional providers.

- Publish or correct SPF and DKIM for each authorised sender, then inspect aggregate reports for alignment failures.

- Choose a DMARC policy that fits the evidence and your organisation's risk tolerance; increase enforcement only after testing legitimate traffic.

- Retain a rollback path and monitor reports after each policy change.

## FAQ

### Does DMARC require both SPF and DKIM to pass?

 No. DMARC can pass when either SPF or DKIM passes **and** that mechanism aligns with the visible From domain.

### What is a good rua address?

 Use an address or reporting service that you control and actively monitor. If it is hosted on another domain, follow the DMARC external-reporting authorisation rules before relying on it.

## Related

- SPF record check

- DKIM record check

- DNS MX record check



## Lemwatch at a glance

- What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool.
- Free plan: 10 sites, no time limit, all check types.
- Pro: $19/mo, 50 sites, public API and webhooks.
- Agency: $59/mo, 150 sites, white-label status pages.
- Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits).



## Related

- [Help centre](https://lemwatch.com/help)
- [SPF record check](https://lemwatch.com/help/spf-record-check)
- [DKIM record check](https://lemwatch.com/help/dkim-record-check)
- [DNS MX record check](https://lemwatch.com/help/dns-mx-record-check)
- [Blacklist & reputation check](https://lemwatch.com/help/blacklist-reputation-check)
- [Open port scan check](https://lemwatch.com/help/open-port-scan-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [DNS A record change check](https://lemwatch.com/help/dns-a-record-change-check)