Enter a domain to look up its DMARC record and get a plain verdict on how strongly its policy is enforced.
DMARC is published as a TXT record at _dmarc.domain, starting with v=DMARC1. The checker parses the policy tags: p sets what happens to mail that fails authentication (none, quarantine or reject), sp applies the same choice to subdomains, pct sets the percentage of failing mail the policy applies to, rua and ruf give mailto addresses where aggregate and failure reports are sent, and adkim and aspf set relaxed or strict alignment for DKIM and SPF identifiers. The result is summarised as an enforcement verdict, from monitoring-only through to full rejection.
What is the difference between p=none, p=quarantine and p=reject? p=none is monitoring only, failing mail is still delivered and the domain collects reports. p=quarantine tells receivers to treat failing mail as suspect, usually by sending it to spam. p=reject tells receivers to refuse failing mail outright, which is the strongest enforcement.
What do rua and ruf do? rua lists mailto addresses for aggregate reports, daily summaries from receivers about mail seen for the domain. ruf lists mailto addresses for failure reports about individual failing messages. Not all receivers send failure reports.
Does DMARC on the main domain cover subdomains? By default the p policy also covers subdomains unless the sp tag sets a different subdomain policy. A subdomain can also publish its own _dmarc record, which takes precedence for that subdomain.