Checker · DMARC DMARC checker: what happens to mail that fails?
DMARC tells receivers what to do with mail that claims to be from your domain but fails SPF and DKIM alignment, and where to send reports about it. This checker finds the record (walking up to the parent domain if needed), validates every tag and spells out the policy in effect.
- 10 record types
- Compare 3 resolvers
- Sent only when you click
Check a DMARC record
Enter the domain (the tool queries _dmarc.
cloudflare-dns.com), Google (dns.google) or Alibaba Cloud (dns.alidns.com) — for the name and record type, nothing else. Checks that follow a chain (SPF includes, MX hosts) send those names to the same service. TapCub’s servers are not involved and store nothing.Subdomains, underscore names such as _dmarc.example.com and international domains all work.
In mainland China, Alibaba Cloud is usually reachable when the other two are not.
Starts with v=DMARC1. Checked in your browser.
Summary
- Note“pct” was removed in RFC 9989 (May 2026). Receivers on the new standard ignore it; older ones still read it.
- OKp=quarantine: mail that fails DMARC should go to spam.
- NoteSample result: these records were looked up on 2026-11-11 while building this page. Click Look up for live data.
Policy in effect
| Item | Value | Meaning |
|---|---|---|
| This domain (p) | quarantine | To spam |
| Subdomains (sp) | reject | Set in the record |
| Non-existent subdomains (np) | reject | Inherited |
| DKIM alignment | r | Relaxed: same organisational domain is enough |
| SPF alignment | r | Relaxed: same organisational domain is enough |
Tags
| Tag | Value | Meaning | Status |
|---|---|---|---|
v | DMARC1 | Version | OK |
p | quarantine | Policy for this domain | OK |
sp | reject | Policy for subdomains | OK |
pct | 100 | Percentage of failing mail the policy applies to | Removed in RFC 9989 |
rua | mailto:dmarc@github.com | Where aggregate reports go | OK |
ruf | mailto:dmarc@github.com | Where failure reports go | OK |
fo | 1 | When to send failure reports | OK |
v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1Share these inputs: the values go after the # in the link, so they never reach a server.
https://tapcub.com/tools/dns-lookup/dmarc
Version v1.0Updated Update history
Reading a DMARC result
The policy table shows what receivers will actually do.
p: the policy
none collects reports only, quarantine sends failing mail to spam, reject refuses it. Most domains start at none, read the reports, then move up.
sp and np: subdomains
sp covers existing subdomains, np (new in RFC 9989) covers names that do not exist. Left out, they inherit the policy above them.
adkim and aspf: alignment
Relaxed (default) accepts a subdomain of the From domain; strict needs an exact match. Strict breaks some third-party senders.
rua: reports
Aggregate reports show every server sending as your domain and whether it passed. Without rua you are guessing. A report address on another domain needs that domain’s permission record.
DMARC passes when SPF or DKIM passes for a domain aligned with the visible From address. Check both with the SPF and DKIM checkers.
Three steps
No sign-up. One click sends the queries.
-
1
Enter a name
A domain, subdomain, URL or email address. Paste an IP address for a reverse lookup.
-
2
Pick type and resolver
Common types is the usual start. Choose “Compare all three” after a DNS change to see whether it has spread.
-
3
Look up and copy
Read the summary, then copy the zone-file lines or download them. Open the MX, SPF, DMARC or DKIM checker for mail records.
DMARC rules, old and new
RFC 7489 (2015) was replaced in May 2026 by RFC 9989 (policy), RFC 9990 (aggregate reports) and RFC 9991 (failure reports). Receivers are moving at different speeds, so this checker reads both.
- The record lives at
_dmarc.<domain>and must start withv=DMARC1; more than one record means no policy is applied - No record at a subdomain: receivers look higher up. RFC 9989 walks up the DNS tree; RFC 7489 used the organisational domain
- RFC 9989 removed
pct,rfandri; it addednp,psdandt(t=y roughly replaces pct=0) - A missing p is treated as p=none under RFC 9989; RFC 7489 only did so when rua was valid
- Reports sent to another domain need
<your-domain>._report._dmarc.<their-domain>TXT v=DMARC1 there (RFC 7489 §7.1)
| Tag | Values | Default |
|---|---|---|
| p | none / quarantine / reject | — (none under RFC 9989) |
| sp / np | none / quarantine / reject | Inherits p (np inherits sp) |
| adkim / aspf | r / s | r |
| rua / ruf | mailto: addresses, comma-separated | No reports |
| fo | 0 / 1 / d / s | 0 |
| pct, rf, ri | Removed in RFC 9989 | 100, afrf, 86400 |
| t / psd | y, n / y, n, u | n / u |
github.com’s DMARC record
Looked up on 2026-11-11: v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1
| Tag | Value | Reading |
|---|---|---|
| p | quarantine | Failing mail from github.com goes to spam |
| sp | reject | Stricter for subdomains: forged mail from any subdomain is refused |
| np | (not set) | Inherits sp: reject |
| pct | 100 | Applies to all failing mail; under RFC 9989 the tag is simply ignored |
| rua / ruf | mailto:dmarc@github.com | Reports go to GitHub’s own domain, so no permission record is needed |
| fo | 1 | Ask for a failure report when either SPF or DKIM fails |
Records change. Click Look up for the current values; the sample keeps its date.
DMARC mistakes
Usually the record is fine and something else is in the way.
Never leaving p=none
none is a monitoring mode. Once the reports show all your real senders passing, move to quarantine and then reject.
rua without mailto:
“rua=dmarc@example.com” is invalid; it must be “rua=mailto:dmarc@example.com”. Receivers send nothing to an invalid address.
Forgetting subdomains
sp=none on a reject policy leaves every subdomain open to forgery. Leave sp out to inherit p, or set it explicitly.
Where domains show up in your analytics
DNS answers practical questions behind the reports: who sent this traffic, which network a crawler came from, and how the tracking script is served.
Referring domains
Sources lists the sites that send visitors. Look up an unfamiliar one to see whether it resolves and who hosts it before you trust its traffic.
Learn moreBots counted separately
TapCub separates crawlers from people with five layers, one of them hosting networks. A PTR lookup shows the hostname a crawler’s IP publishes.
Learn moreNo CNAME tricks
TapCub does not use CNAME aliasing to make its requests look first-party. The cookie policy lists what else it deliberately does not do.
Learn moreDNS lookup questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What DMARC policy should I start with?
p=none with a rua address, so you receive reports without affecting delivery. Fix the senders that fail, then move to quarantine and reject. Gmail and Yahoo accept p=none for bulk senders.
Is pct still supported?
RFC 9989 (May 2026) removed pct, rf and ri, and receivers that implement it ignore them. Receivers still on RFC 7489 read pct. If you used pct=0 to test, the new t=y tag is the intended replacement.
Do I need DMARC if I have SPF and DKIM?
Yes for most senders: Gmail requires a DMARC record from anyone sending more than 5,000 messages a day to Gmail accounts, and Yahoo and Outlook.com publish similar rules. DMARC is also what lets receivers act on SPF and DKIM failures for the From address.
Why does my subdomain show the parent’s policy?
Because it has no record of its own. Receivers look up the tree and apply the record they find there, using sp (or np for names that do not exist) if it is set.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
From the domain to the visitors it brings
TapCub shows where visitors come from, separates bots from people, and adds live chat on the same snippet. No cookies in the default mode.