What does p=none mean in DMARC?

It means monitoring only. Mail that fails SPF and DKIM alignment is still delivered normally, and you simply receive reports about it. It is the correct first step because it cannot break legitimate mail, but a domain that stays on p=none is still fully spoofable.

How do I check DMARC in Office 365?

The DMARC record lives in your domain's DNS, not in Office 365, so enter the domain above. To check DMARC on a message received in Outlook, open View message details and look for dmarc=pass or dmarc=fail in the Authentication-Results header, or paste the headers into the email header analyzer.

How do I check a DMARC record with nslookup?

Run nslookup -type=txt _dmarc.example.com, or dig txt _dmarc.example.com on Mac and Linux, replacing example.com with your domain. The answer should be one TXT record starting v=DMARC1. No answer means the domain has no DMARC record.

How do I check DMARC and DKIM together?

Run the deliverability audit, which checks MX, SPF, DKIM, DMARC and blocklists in one pass. To see whether DKIM and DMARC actually passed on a real message, paste its headers into the email header analyzer.

Effectively yes for bulk senders. Since February 2024 Google and Yahoo have required a DMARC record on domains sending bulk mail to their users. A p=none record satisfies that requirement, though it provides no enforcement on its own.

What is the difference between DMARC quarantine and reject?

Quarantine asks receivers to treat failing mail as suspicious, which in practice means the spam folder. Reject asks them to refuse it during the SMTP conversation so it is never delivered at all. Reject is stronger; quarantine is the safer intermediate step while you confirm no legitimate sender is failing.

DMARC record checker

In short: Check any domain's DMARC record: see the raw TXT at _dmarc, every tag (p, sp, pct, rua, adkim, aspf) explained, and an honest grade of what it enforces. Limit: It reads the published policy. It does not read DMARC reports, so it can't tell you which senders pass or fail.

A DMARC checker reads the TXT record at _dmarc.yourdomain.com and reports the policy it publishes: none, quarantine or reject. To check DMARC, enter the domain above. The policy is the point of the record: p=none asks for reports and blocks nothing, so a domain on it can still be spoofed.

Free, no account. You don't need to type the _dmarc prefix. Ten lookups a minute.

By SimpleVerifier Team · Last updated October 17, 2026

Run 33 times this week

Also in: Português (Brasil) · Español · Deutsch · Français · Türkçe · 简体中文 · Русский

SimpleAPI

Sample result

acme.example has a DMARC policy of p=none, so it blocks nothing.

Domain: acme.example
Policy: Reports only, blocks nothing
Reports to: [email protected]

What this means for you

Reports arrive, but spoofed mail still gets through; move to quarantine once reports look clean.

Next step:Build a stricter DMARC policy

Reads the TXT record at _dmarc
Shows the policy: none, quarantine or reject
Explains what the policy really enforces
Shows the raw record as published

DMARC
Policy
DNS

SimpleAPI

Sample result

acme.example has a DMARC policy of p=none, so it blocks nothing.

Domain: acme.example
Policy: Reports only, blocks nothing
Reports to: [email protected]

What this means for you

Reports arrive, but spoofed mail still gets through; move to quarantine once reports look clean.

Next step:Build a stricter DMARC policy

Reads the TXT record at _dmarc
Shows the policy: none, quarantine or reject
Explains what the policy really enforces
Shows the raw record as published

DMARC
Policy
DNS

What do DMARC none, quarantine and reject mean?

They are the three policies a domain can publish, from weakest to strongest. p=none is monitoring only. Failing mail is delivered normally and you receive reports about it. This is the correct starting point and the wrong finishing point: a domain on p=none can be spoofed by anyone.

p=quarantine tells receivers to treat failing mail as suspicious, in practice sending it to spam. p=reject tells them to refuse it outright. Reject is the goal, and the path there is to publish none, read the reports until every legitimate sender passes, then move up.

What does a DMARC check actually test?

On a message, a DMARC check tests alignment: whether a passing SPF or DKIM domain matches the From domain. DMARC adds a requirement neither SPF nor DKIM has on its own: the domain that passed authentication must match the domain in the visible From header. This is called alignment, and it closes the exact gap that let a spammer pass SPF for their own domain while displaying yours.

Alignment can be relaxed, the default, where a subdomain matches the parent, or strict via aspf=s and adkim=s, where it must match exactly. Relaxed is right for most senders, because email service providers frequently sign with a subdomain.

What are rua and ruf in a DMARC record?

They are the reporting addresses. rua= names where aggregate reports go: daily XML summaries of what passed and failed, per sending source. These are how you discover the vendor nobody told you about that has been sending as your domain for a year.

ruf= requests forensic reports on individual failures. Most large receivers no longer send them for privacy reasons, so do not rely on it. Aggregate reports are the useful half, and they are hard to read by hand, so point them at a parsing service.

Is DMARC required by Google and Yahoo?

Yes, for bulk senders. Since February 2024, Google and Yahoo require a DMARC record on any domain sending bulk mail to their users. Publishing p=none satisfies the requirement, which is why a great many domains published exactly that and stopped.

That is a real improvement on nothing, because it turns the reports on. But the enforcement benefit only arrives at quarantine or reject, and a domain left at p=none indefinitely has the paperwork without the protection.

How do I check my DMARC record?

Type the domain into the box. Leave off the _dmarc. prefix; the tool adds it.
Press Check DMARC. The tool reads the TXT record at _dmarc. plus your domain.
Read the grade and the tags: p is the policy (none, quarantine or reject), pct how much of it applies, rua where reports go. none means nothing is blocked yet.
If there is no record, or it sits at none, build the next step with the DMARC generator.

Example

You enter: The domain acme.example.
You get: DMARC present but p=none, so nothing is enforced: reports go to [email protected], but spoofed mail still gets through.
Limits: Ten lookups a minute per IP address, one domain at a time; a DNS lookup only.

Who uses this tool, and for what?

Cold emailers: Check every sending domain meets the Google and Yahoo bulk sender rule, which needs at least a p=none record.
IT admins: Confirm a policy change to quarantine or reject was published correctly, at the _dmarc host and not the root domain.
Agencies: Show a client, with their own raw record, that p=none still lets anyone send mail as their domain.

What can’t this tool tell you?

It reads the published policy. It does not read DMARC reports, so it can't tell you which senders pass or fail.
A subdomain without its own record falls back to the parent domain's policy, or its sp= value. Check the parent too.
It doesn't tell you whether SPF and DKIM are aligned for your senders; the email header analyzer shows that on a real message.

Sources

Common questions

How do I check my DMARC record?: Paste your domain into the tool above. It queries the TXT record at _dmarc.yourdomain.com, falls back to the parent domain for subdomains the way receivers do, explains every tag, and grades how much the policy actually enforces. You do not need to enter the _dmarc prefix yourself.
What does p=none mean in DMARC?: It means monitoring only. Mail that fails SPF and DKIM alignment is still delivered normally, and you simply receive reports about it. It is the correct first step because it cannot break legitimate mail, but a domain that stays on p=none is still fully spoofable.
How do I check DMARC in Office 365?: The DMARC record lives in your domain's DNS, not in Office 365, so enter the domain above. To check DMARC on a message received in Outlook, open View message details and look for dmarc=pass or dmarc=fail in the Authentication-Results header, or paste the headers into the email header analyzer.
How do I check a DMARC record with nslookup?: Run nslookup -type=txt _dmarc.example.com, or dig txt _dmarc.example.com on Mac and Linux, replacing example.com with your domain. The answer should be one TXT record starting v=DMARC1. No answer means the domain has no DMARC record.
How do I check DMARC and DKIM together?: Run the deliverability audit, which checks MX, SPF, DKIM, DMARC and blocklists in one pass. To see whether DKIM and DMARC actually passed on a real message, paste its headers into the email header analyzer.
Is DMARC required?: Effectively yes for bulk senders. Since February 2024 Google and Yahoo have required a DMARC record on domains sending bulk mail to their users. A p=none record satisfies that requirement, though it provides no enforcement on its own.
What is the difference between DMARC quarantine and reject?: Quarantine asks receivers to treat failing mail as suspicious, which in practice means the spam folder. Reject asks them to refuse it during the SMTP conversation so it is never delivered at all. Reject is stronger; quarantine is the safer intermediate step while you confirm no legitimate sender is failing.

How do I check MX, SPF, DKIM and DMARC at once?

Run the deliverability audit: this page covers one record, and the full deliverability audit runs MX, SPF, DKIM, DMARC and blocklists together and scores the domain. Just bought a domain to send from? The new domain email setup check checks up to 25 at once and gives the exact Google Workspace, Microsoft 365 or Zoho records to add, or read the glossary entry for the concept behind this check.

Embed this tool on your site

Paste this code into any page to give your readers the DMARC record checker for free. The frame resizes to fit and works on light and dark pages. Keep the link under it so readers can find the full guide. More tools to embed are on the embeddable tools page.

HTML

<iframe src="https://simpleverifier.com/embed/tools/dmarc-checker" title="DMARC record checker by SimpleVerifier" data-sv-embed="dmarc-checker" width="100%" height="640" loading="lazy" allow="clipboard-write" style="border:0;width:100%;max-width:760px;display:block"></iframe>
<p style="margin:6px 0 0;font-size:13px"><a href="https://simpleverifier.com/tools/dmarc-checker">Free DMARC record checker by SimpleVerifier</a></p>
<script>(function(){if(window.__svEmbed)return;window.__svEmbed=1;window.addEventListener("message",function(e){if(e.origin!=="https://simpleverifier.com")return;var d=e.data;if(!d||d.type!=="simpleverifier:embed-height"||typeof d.slug!=="string"||typeof d.height!=="number"||!isFinite(d.height))return;var f=document.querySelectorAll("iframe[data-sv-embed]");for(var i=0;i<f.length;i++){if(f[i].contentWindow===e.source){f[i].style.height=Math.min(Math.max(Math.ceil(d.height),200),4000)+"px";}}});})();</script>

You audited one domain. Cold outreach means thousands.

This tool checks a domain you type in. It will not tell you which addresses at that domain are real.

Bulk mailbox verification with real SMTP checks
The email finder — name plus company to a verified address
Website enrichment for emails, owner names and socials

Get started — $39/mo See the published limits first

Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.