How do I check if my domain has a DMARC record?

Query the TXT record at _dmarc.yourdomain.com. On the command line: dig +short TXT _dmarc.example.com. In a browser, open https://dns.google/resolve?name=_dmarc.example.com&type=TXT. If nothing comes back, you have no DMARC record and your domain can be spoofed.

What does p=none mean in a DMARC record?

p=none is monitor-only: the domain owner receives reports of messages that fail authentication but no mail is blocked. It's a safe starting point but provides no protection until you move to p=quarantine and then p=reject.

What is a strong DMARC record?

One at p=reject (or at least p=quarantine) with a rua address collecting reports, backed by correctly configured SPF and DKIM. p=reject means mail failing authentication is refused, which is what actually stops spoofing.

How to Check and Read Your DMARC Record

Updated August 2026 · about a 6-minute read

A DMARC record is what stops attackers from sending email as your domain — and tells you when they try. But a record that exists isn't the same as a record that protects you. Here's how to check whether you have one, and how to read what it actually says.

Check if you have a DMARC record

DMARC lives in a TXT record at _dmarc.yourdomain.com. From the command line:

dig +short TXT _dmarc.example.com

Or without any tools, query it over DNS-over-HTTPS in a browser:

https://dns.google/resolve?name=_dmarc.example.com&type=TXT

No result means you have no DMARC protection at all — anyone can spoof your domain. If you get a record, read on.

Read the record

A typical record looks like:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100; sp=quarantine

Tag	Meaning
v=DMARC1	Version — must be first
p=	Policy for failures: none, quarantine, or reject
rua=	Where aggregate reports are sent
pct=	Percentage of mail the policy applies to (ramp with this)
sp=	Policy for subdomains

The part that matters: p=

p=none — monitor only. Reports spoofing but blocks nothing. A useful starting point, and a very common place records get stuck forever.
p=quarantine — failing mail goes to spam.
p=reject — failing mail is refused outright. The goal state.

If your record says p=none, you're seeing the spoofing in reports but not stopping it. The path to real protection is none → quarantine → reject, covered in how to stop email spoofing. Note that as of the 2026 DMARCbis update, enforcement by mailbox providers like Gmail and Yahoo is stricter than ever.

Keep checking it

DNS records get edited, and a record can quietly revert to p=none or disappear in a migration. Our free checker flags a missing DMARC record and a policy stuck at p=none, alongside your TLS and header posture. Check your domain below.

Check your site now — free, no signup

See your TLS certificate, security headers and DNS graded in seconds. Then let Perimeter watch it and email you the moment something breaks.

Open the full checker →