Check your domain's DMARC record
Type a domain. You get the live record from public DNS, each tag explained, and the one change to make next.
- Live DNS lookup
- Plain-English fixes
- No email required
The short answer
- A DMARC record is a TXT record at _dmarc.yourdomain.com that tells receivers what to do with mail failing SPF and DKIM alignment.
- Every sending domain needs exactly one DMARC record with a v=DMARC1 tag first and a p= policy.
- Google's sender guidelines require DMARC from anyone sending more than 5,000 messages a day to Gmail, and p=none satisfies them.
- Add a rua= address so aggregate reports reach you, then tighten the policy from none to quarantine to reject.
How the checker grades your record
Your browser asks Cloudflare's public resolver for the TXT records at _dmarc.yourdomain, using DNS-over-HTTPS. If Cloudflare doesn't answer, it asks Google Public DNS. Nothing passes through our servers. Each record that starts with v=DMARC1 is then split into its tags and graded:
- Fix: no record, more than one record, a missing p= tag, or a record that doesn't open with v=DMARC1.
- Check: p=none, a pct= value under 100, or no rua= reporting address.
- OK: p=quarantine or p=reject, a rua= address, an sp= subdomain policy, and the alignment mode.
Alignment defaults to relaxed when adkim= or aspf= is absent, as the DMARC standard (RFC 7489) sets it. Relaxed lets mail from a subdomain pass for the parent domain.
DMARC tags, what they do and the safe starting value
| Tag | What it controls | Starting value |
|---|---|---|
| v | Record version; must come first | DMARC1 |
| p | Policy for failing mail on this domain | none, then quarantine, then reject |
| rua | Where daily aggregate reports go | mailto: a mailbox you read |
| pct | Share of failing mail the policy applies to | 100 |
| sp | Policy for subdomains | Same as p, once reports are clean |
| adkim / aspf | Strict or relaxed alignment for DKIM and SPF | r (relaxed) |
Gmail bulk-sender rule checked on Google's Email sender guidelines (support.google.com/a/answer/81126), September 2026.
Three records, three verdicts
No record at all. A lookup that returns nothing gets one Fix: publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. That single line meets Google's bulk-sender rule.
v=DMARC1; p=none. You'll see Check twice: the policy is monitoring only, and no reports reach you because rua= is missing. Add the reporting address first, since reports tell you when it's safe to tighten.
v=DMARC1; p=reject; rua=mailto:d@example.com; pct=50. The policy and reporting pass. The pct=50 gets a Check, because half of your failing mail still slips through untouched.
Give every cold email domain its own DMARC record
Questions
- How do I check my DMARC record?
- Look up the TXT record at _dmarc followed by your domain, for example _dmarc.example.com. The checker above does that lookup live over DNS-over-HTTPS and reads each tag back to you in plain words.
- What is a good DMARC policy?
- Start at p=none with a rua= reporting address, read the reports for two to four weeks, then move to p=quarantine and finally p=reject. Google accepts p=none for its bulk-sender rule.
- Do I need DMARC for cold email?
- Yes, once you send volume to Gmail. Google's sender guidelines require DMARC for anyone sending more than 5,000 messages a day to Gmail accounts, and p=none meets the rule.
- Why does my domain have two DMARC records?
- Usually two tools each asked you to add one. Receivers treat more than one DMARC record as no record at all, so merge the tags into a single TXT record.
Send from domains you've set up properly
SalesCrew runs cadences on your own mailboxes with daily caps per mailbox and per domain, and suppression re-checked at send.