DMARC check

Finds the DMARC record for the domain or its organisational domain, validates the tags and explains policy, subdomain policy, alignment and reporting addresses.

Updated 2026-10-26

What this tool checks

The DMARC check follows policy discovery in RFC 9989, which replaced RFC 7489 in May 2026. It queries _dmarc.DOMAIN, where DOMAIN is the domain you give, and then _dmarc at each parent name up to the top-level domain (the DNS tree walk, at most eight queries). From the records it finds, it determines the organisational domain and the record that applies: the domain's own record, otherwise the organisational domain's, otherwise that of the public suffix domain.

It validates the tags and reports syntax errors and unknown tags.
It explains the policy p, the subdomain policy sp, the policy for non-existent subdomains np, and testing mode t=y.
It reports the effective policy. A missing p counts as none. If p, sp or np is invalid, the policy is treated as none when a valid rua is present, and no DMARC applies otherwise, as the RFC describes.
When an inherited record has an np tag that differs from sp, it looks up the domain itself to see whether it exists.
It lists report addresses and notes the ones that are not mailto: addresses, because receivers are only required to support mailto:.
It flags p=none, testing mode, the removed tags pct, rf and ri, a missing rua, and multiple records.

How to read the result

The result separates what is published from what applies. If the record comes from a parent domain, the result says so and names it. A finding is information about the record, not a judgement of your mail setup.

An enforced policy (quarantine or reject, not in testing mode) is also a requirement for brand logos in mail clients. The BIMI record check shows whether a domain qualifies.

Limitations

The check reads the published records only. It does not look at DMARC reports or at how your mail actually authenticates.
Alignment settings are explained, but whether your mail aligns depends on SPF and DKIM for each message.
Reports sent to other domains need an authorisation record at that domain (RFC 9990 section 4). The check does not test that.

Use it from code

API reference for DMARC check

curl -i "https://api.lookproof.dev/v1/mail/dmarc?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.01 per check

Findings this tool can report

DMARC (12)

Info DMARC_HISTORIC_TAG The DMARC record contains a tag that RFC 9989 lists as historic.
Info DMARC_INHERITED The DMARC policy comes from a parent domain.
Error DMARC_INVALID_POLICY The DMARC record has an invalid p, sp or np tag.
Error DMARC_MULTIPLE_RECORDS More than one DMARC record was found.
Warning DMARC_NOT_FOUND No DMARC record was found for the domain or any of its parent domains.
Info DMARC_NO_RUA The DMARC record has no aggregate report address (rua).
Info DMARC_PARTIAL_PCT The DMARC record uses pct below 100, a tag that RFC 9989 removed.
Info DMARC_POLICY_NONE The DMARC policy is p=none (monitoring only).
Error DMARC_SYNTAX_ERROR The DMARC record contains a tag that cannot be parsed or has an invalid value.
Info DMARC_TESTING_MODE The DMARC policy is in testing mode (t=y).
Info DMARC_UNKNOWN_TAG The DMARC record contains tags that are not defined.
Info DMARC_UNSUPPORTED_REPORT_URI A DMARC report address uses a scheme other than mailto.

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (2)

Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Frequently asked questions

What does p=none do?

A none policy asks receivers not to take action on mail that fails DMARC. It is used to collect reports before moving to quarantine or reject. The check flags it so that it is a conscious choice and not a leftover.

Why does my subdomain show the parent's policy?

When a subdomain has no DMARC record of its own, receivers use the record of its organisational domain (RFC 9989 section 4.10.1). The check does the same and reports that the policy is inherited. The parent's sp tag applies to subdomains that exist, and its np tag to names that do not exist.

How does the check find the organisational domain?

With the DNS tree walk of RFC 9989: it queries _dmarc at the name and at each parent up to the top-level domain, at most eight queries. The organisational domain is the shortest name with a DMARC record, unless a psd tag says otherwise. Earlier versions of DMARC used the Public Suffix List for this.

Is pct still supported?

No. RFC 9989 removed pct, rf and ri. Receivers that follow it ignore pct and apply the full policy. To test a policy without it being applied, use t=y. The check reports a pct below 100 so you can remove it.

Does a reporting address mean I will receive reports?

The rua tag only says where aggregate reports should be sent. Whether a receiver sends them is up to the receiver. The check reports that rua is missing or uses an unsupported address type.