DMARC record checker
Check your DMARC policy, report addresses and alignment settings, and see what to tighten so email from your domain stays trusted after a move.
What this tool checks
DNSPeek reads the TXT record at _dmarc of the domain, or of the organisational domain when a subdomain has none, and parses every tag: the policy for the domain and its subdomains, pct, the aggregate and failure report addresses and the DKIM and SPF alignment mode. Report addresses on other domains are checked for the authorisation record receivers require.
How to read the result
The policy is what receivers do with mail that fails: none delivers it, quarantine sends it to spam, reject refuses it. Warnings explain what weakens the policy (p=none, pct below 100) and what is missing (no reports). Errors mean receivers may ignore the record altogether.
What to check after a migration
With p=quarantine or p=reject, mail from a new server that is not covered by SPF or signed with DKIM goes to spam or bounces. Before the switch, add the new server to SPF with the SPF checker or route its mail through your provider, and watch the next aggregate reports.
Frequently asked questions
What is DMARC?
DMARC is a TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with messages that fail both SPF and DKIM alignment, and where to send reports about the mail they see from your domain.
Which policy should I use?
Start with p=none and a rua address to collect reports. When the reports show that all your legitimate senders pass, move to p=quarantine and then p=reject, which gives the strongest protection against spoofing.
What does pct mean?
pct is the share of failing messages the policy applies to. pct=25 with p=quarantine sends only a quarter of failing mail to spam. It is a way to tighten the policy gradually; the default is 100.
Why does it say reports are not authorised?
When rua points to an address on another domain, such as a reporting service, that domain must publish a TXT record allowing it. Without it, many receivers do not send reports there.
Does a subdomain need its own DMARC record?
No. Without its own record, a subdomain uses the record of the organisational domain, with the sp= policy if one is set. This tool shows which record applies.
Moving a site to a new server?
See the site on the new server before you change DNS: DNSPeek gives you one HTTPS preview link that works on any device and that you can share with your team or client. No hosts file, no VPN.
Create a free preview link