A DMARC record is a DNS TXT record that tells receiving mail servers how to evaluate messages claiming to come from your domain name. DMARC, defined in RFC 7489, builds on two core email authentication methods: SPF and DKIM. Together, these mechanisms help determine whether an email is legitimate, aligned with the sending domain, and safe to deliver.
A DMARC lookup is the process of finding and reading the published DMARC DNS entry. A DMARC record lookup helps a Domain admin confirm that the domain has a valid DMARC record, that the DMARC policy is configured correctly, and that reporting destinations are receiving useful data.
Table of Contents
How DMARC Supports Email Authentication
DMARC is an authentication protocol that connects SPF and DKIM results to the visible Header From domain. This matters because attackers often pass basic infrastructure checks while spoofing the brand that users actually see.
DMARC evaluates:
- SPF alignment, where the return-path domain aligns with the Header From domain
- DKIM signature alignment, where the DKIM signing domain aligns with the Header From domain
- The published DMARC policy, such as p=none, p=quarantine, or p=reject
Why a DMARC Lookup Is Operationally Important
A DMARC checker, or DMARC record checker, serves as a diagnostic tool to identify errors before ISPs, Google, Yahoo, and other mailbox providers reject or filter legitimate mail. A DMARC lookup also provides visibility into whether unauthorized emails are being sent from your domain name.
For organizations working toward DMARC compliance, regular DMARC validation is essential. It helps detect misconfigurations, protects against impersonation, and strengthens both phishing protection and spoofing protection across the email ecosystem.
How to Find a DMARC Record in DNS
A DMARC record is published in DNS as a TXT Record at a specific hostname:
_DMARC.example.com
For any domain name, replace example.com with the domain you want to inspect. A DMARC record lookup queries this location and returns the current policy and tags.
Using Online DMARC Lookup Tools
The simplest method is to use a DMARC checker such as EasyDMARC, MXToolbox, or DMARCian. These tools perform a DMARC lookup, display the raw record, and often provide configuration analysis.
A good DMARC record checker will identify:
- Whether a DMARC record exists
- Whether the syntax is valid
- What DMARC policy is active
- Whether the rua and ruf reporting addresses are configured
- Whether SPF and DKIM alignment are likely to pass
Because these platforms function as a diagnostic tool, they are useful for quick record testing, troubleshooting, and stakeholder reporting.
Using DNS Commands
You can also find a DMARC record manually with command-line DNS tools.
Dig Example
dig TXT _DMARC.example.com
Nslookup Example
nslookup -type=TXT _DMARC.example.com
The response should return one TXT value beginning with the v tag, usually:
v=DMARC1; p=none; rua=mailto:DMARC-reports@example.com
If no result appears, the domain name may not have a DMARC record published, or the record may be placed incorrectly. A manual DMARC record lookup is useful, but a dedicated DMARC record checker usually explains errors more clearly.
How to Test and Interpret DMARC Lookup Results
After you find the record, the next step is to run a DMARC check and interpret the tags. A DMARC checker translates the DNS TXT record into operational meaning, helping you understand how receiving email servers will treat messages from your domain name.
Key DMARC Tags to Review
A standard DMARC record contains required and optional tags. The most important include:
v Tag
The v tag identifies the record version. It must be:
v=DMARC1
If this value is missing or misspelled, DMARC validation will fail.
p Tag and Policy Tag
The p tag, also called the policy tag, defines the main DMARC policy for the organizational domain:
- p=none: Monitor only; no enforcement
- p=quarantine: Send failing messages to spam or quarantine
- p=reject: Reject failing messages at the email server
A reject policy provides the strongest protection, while quarantine is often used as an intermediate stage before full DMARC enforcement.
Reporting Tags
The rua tag specifies where to send an aggregate report, usually in XML report format:
rua=mailto:DMARC-aggregate@example.com
The ruf tag specifies where to send a forensic report:
ruf=mailto:DMARC-forensic@example.com
Forensic reporting can use formats such as afrf or references such as iodef, though many ISPs limit or redact forensic data for privacy reasons. The reporting URI should point to a monitored mailbox or a DMARC reporting platform.
Alignment and Enforcement Tags
Other useful tags include:
- adkim: Controls DKIM alignment strictness
- aspf: Controls SPF alignment strictness
- fo tag: Defines failure reporting options
- pct tag: Applies policy to a percentage of messages
- ri tag: Sets the interval for aggregate reporting
- sp: Defines a subdomain policy
Example of a More Advanced Record
v=DMARC1; p=quarantine; pct=50; rua=mailto:DMARC@example.com; ruf=mailto:forensics@example.com; adkim=s; aspf=s; fo=1
A DMARC record checker can evaluate whether this configuration is valid and whether it matches your email authentication goals.
Interpreting SPF, DKIM, and Alignment Results
A strong DMARC check should be reviewed alongside an SPF check and a DKIM check. Passing SPF or DKIM alone is not always enough; DMARC also requires domain alignment.
For example:
SPF may pass, but SPF alignment may fail if the return-path uses a third-party domain
DKIM may pass, but DKIM signature alignment may fail if the signer does not match your Header From domain
DMARC passes if either aligned SPF or aligned DKIM passes
This is why a DMARC lookup should be part of broader email authentication analysis, not a standalone task.
Common DMARC Record Errors and How to Fix Them
No DMARC Record Found
If a DMARC record lookup returns nothing, confirm that the record is published at:
_DMARC.yourdomain.com
Do not publish it at the root domain unless your DNS provider specifically abstracts the host field. The value must be a TXT Record, not MX, CNAME, or SPF type.
Fix: create one valid DNS TXT record starting with v=DMARC1.
Multiple DMARC Records
A domain should have only one DMARC record. Multiple records cause DMARC validation to fail because receivers cannot determine the correct DMARC policy.
Fix: consolidate all required tags into a single DMARC record.
Invalid Syntax or Unsupported Tags
Common syntax errors include missing semicolons, misspelled tags, invalid mailto syntax, or incorrect capitalization in v=DMARC1.
Fix: run a DMARC check with a DMARC record checker, then correct the exact tag errors reported by the diagnostic tool.
Reporting Address Problems
Incorrect rua or ruf destinations prevent useful reporting. If reports are sent to an external domain, that domain may need to authorize report receipt in DNS.
Fix: verify every reporting URI, confirm mailbox capacity, and ensure XML reports from ISPs are being parsed. Without aggregate report analysis, you lose visibility into authorized senders and unauthorized emails.
Policy Too Strict Too Soon
Moving directly to p=reject can block legitimate messages if SPF, DKIM, or third-party senders are not configured correctly.
Fix: start with p=none, monitor reports, move to p=quarantine, and then apply p=reject when legitimate sources pass email authentication consistently.
Best Practices for Monitoring and Maintaining DMARC Records
Run Regular DMARC Checks
Schedule a recurring DMARC check for every important domain name, including parked domains and high-risk subdomains. Use a DMARC checker or DMARC record checker to verify that the active DMARC record remains valid after DNS changes.
This process should include:
- Record testing after DNS updates
- SPF check and DKIM check validation
- Configuration analysis for third-party senders
- Review of DMARC policy progression
- Detection of new misconfigurations
Monitor Reports and Sender Sources
Review aggregate report data to identify legitimate systems, shadow IT, and unauthorized emails. XML reports can show which sources pass SPF, DKIM, and DMARC, giving security and deliverability teams the visibility needed to manage the email ecosystem.
Maintain an inventory of authorized senders, including marketing platforms, CRM systems, billing tools, and transactional email providers. Each sender should support proper SPF alignment or DKIM signature alignment.
Progress Toward Enforcement Carefully
A mature DMARC program moves from monitoring to enforcement:
- Start with p=none
- Validate authorized senders
- Move to p=quarantine
- Increase the pct tag gradually if needed
- Adopt p=reject for full spoofing protection
This path supports brand protection without harming email deliverability. Strong DMARC enforcement reduces phishing risk, improves trust with ISPs, and helps preserve brand reputation.
Maintain Organizational and Subdomain Coverage
Your organizational domain should have a clear policy, and your subdomain policy should reflect how subdomains are used. If subdomains do not send email, consider a stricter policy to prevent abuse.
Run a DMARC record lookup for the primary domain and critical subdomains. A recurring DMARC lookup using a trusted diagnostic tool helps ensure your DMARC record, DMARC policy, and overall email authentication posture remain accurate as your infrastructure changes.
