← Back to Blog DMARC Guide

Free DMARC Checker — Test Your Domain's DMARC Record Instantly

Published: April 2026 · 8 min read

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds on SPF and DKIM. It tells email receivers what to do when an email fails authentication checks — quarantine it, reject it, or do nothing.

Without DMARC, anyone can send emails that appear to come from your domain. With DMARC, you can:

• Prevent spoofing — Stop phishing emails that use your domain
• Get reports — See who's sending emails as your domain
• Improve deliverability — Gmail, Microsoft, and Yahoo all check DMARC

Since 2024, both Gmail and Yahoo require DMARC for bulk senders. If you send more than 5,000 emails per day and don't have DMARC, your emails go straight to spam.

Check Your DMARC Record Now

Use our free tool to check your DMARC record in seconds:

curl https://korpo.pro/api/v1/check/yourdomain.com

Or check from the command line:

dig TXT _dmarc.yourdomain.com

A valid DMARC record looks like:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s

How DMARC Works

DMARC works by aligning two other authentication mechanisms:

1. SPF (Sender Policy Framework)

SPF specifies which IP addresses are allowed to send email from your domain. It's a DNS TXT record on your root domain.

2. DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your emails. The public key is published in DNS.

3. DMARC ties it together

DMARC tells receivers: "If SPF or DKIM fails, here's what to do." You set a policy of none (monitor only), quarantine (send to spam), or reject (block entirely).

Common DMARC Errors

❌ No DMARC record at all

This is the most common problem. Over 60% of domains don't have DMARC configured. Without it, email providers make their own decisions about your emails.

❌ DMARC policy set to p=none

A p=none policy means "monitor but don't take action." It's fine for initial rollout, but you should escalate to p=quarantine then p=reject within 30-60 days.

❌ rua tag missing

Without rua=mailto:user@domain.com, you don't get aggregate reports about email authentication failures. You're flying blind.

❌ DMARC record on wrong subdomain

The DMARC record must be at _dmarc.yourdomain.com, not _dmarc.sub.yourdomain.com (unless you're setting subdomain policy separately).

❌ SPF/DKIM alignment failure

Even if SPF and DKIM both pass, DMARC can fail if the domains don't align. The "return-path" domain (SPF) and "d=" tag (DKIM) must match the "From" domain.

DMARC Setup Guide

Step 1: Add the DMARC DNS record

Add a TXT record to your DNS:

Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

Step 2: Monitor reports

Within 24-48 hours, you'll start receiving DMARC aggregate reports at the email address in your rua tag. These XML reports show:

• Which IP addresses are sending emails as your domain
• Whether those emails passed SPF and DKIM
• What action the receiver took

Step 3: Escalate your policy

After 2-4 weeks with p=none and all legitimate sources identified:

• Change to p=quarantine; pct=25 (quarantine 25% of failures)
• Gradually increase to pct=50, then pct=100
• Finally switch to p=reject; pct=100

Monitoring DMARC Reports

DMARC reports come as XML files attached to emails. They're hard to read manually. You can:

• Use our free API — korpo.pro checks your records on demand
• Parse reports yourself — they're XML with structured authentication results
• Use a report processor — open-source tools like parsedmarc can visualize reports

DMARC FAQ

What happens if I don't have DMARC?

Email providers (Gmail, Outlook, Yahoo) will make their own decisions about emails that fail SPF or DKIM. Your emails may go to spam or be silently dropped.

Can DMARC break my email?

Yes, if you set p=reject too early. Always start with p=none to monitor, then gradually escalate.

Does DMARC work for subdomains?

Yes. You can set a separate sp (subdomain policy) tag, or DMARC inherits the root domain policy by default.

What's the difference between p=quarantine and p=reject?

quarantine sends failing emails to spam. reject blocks them entirely. For most businesses, reject is the end goal once you've verified all legitimate senders.

How do I check DMARC for any domain?

Use our free API:

curl https://korpo.pro/api/v1/check/anydomain.com

Or visit korpo.pro and enter the domain.

© 2026 MailCheck — korpo.pro — API Docs — Pricing