How do I check my DMARC record?

Look up the TXT record at _dmarc.yourdomain, for example with dig TXT _dmarc.example.com +short or nslookup -type=TXT _dmarc.example.com. A valid answer is a single line starting with v=DMARC1 and containing a p= policy. If nothing comes back, no DMARC record is published at that name.

Why it matters

A DMARC record can look fine in your DNS panel and still be wrong in practice: published at the wrong name, doubled up, or cut off by a copy and paste. Checking the record as the world sees it, rather than as your panel displays it, is the only way to be sure receivers will read what you intended.

How to check

On macOS or Linux, open a terminal and run:

dig TXT _dmarc.example.com +short

On Windows, use:

nslookup -type=TXT _dmarc.example.com

Read the result. A healthy answer looks like this:

"v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Tick off these points:
- Exactly one record begins with v=DMARC1.
- p= is none, quarantine or reject.
- rua= is present and each address starts with mailto:.
- Tags are separated by semicolons.
If you are checking a subdomain and get no answer, remember that receivers fall back to the record of the main (organisational) domain. Look up _dmarc on the main domain too.
For a live test, send a message from your domain to a mailbox you control and open the original source. The Authentication-Results header should show dmarc=pass, along with the SPF and DKIM results that led to it.
If you just edited the record and the old value still appears, DNS caching is the usual cause. See how long a DMARC change takes to work.

Crawvix's scan checks "DMARC record is published" and "DMARC policy is enforced and reports are sent", so you can see both in one place.

Common mistakes

Looking up example.com rather than _dmarc.example.com.
Trusting a DNS panel preview instead of a real lookup.
Missing a second, older DMARC record that is causing both to be ignored.
Reading dmarc=pass on one message and assuming every sender passes. Check the reports for the full picture.
Checking only the main domain when mail is sent from a subdomain.

Frequently asked questions

What if I get no answer?

Then no DMARC record exists at that name. Create one using the example in What does a correct DMARC record look like?.

Can I check someone else's DMARC record?

Yes. DMARC records are public DNS data, so the lookup works for any domain.

Does the lookup show if my mail passes?

No. It shows your published policy only. Pass or fail results appear in message headers and in the aggregate reports.

Prefer a quick overview of your domain? Try the free website sample.