Where does a DMARC record live?

In a TXT record at the subdomain _dmarc of your domain, e.g. _dmarc.example.com. It must start with v=DMARC1 and contain at least the p tag with the policy none, quarantine or reject.

What is the difference between p=none, quarantine and reject?

p=none only monitors: failing mail is still delivered and you receive reports. p=quarantine asks receivers to treat failures as suspicious, typically landing them in spam. p=reject asks receivers to refuse failing mail outright, which is the end goal of a DMARC rollout.

Why do I need the rua tag?

rua=mailto:you@example.com tells receivers where to send aggregate reports. Without it you fly blind: you cannot see who is sending mail as your domain or whether legitimate mail would break before tightening the policy.

DMARC Record Validator

DMARC record to validate

Or paste a record above to validate it before publishing. Fetch reads the TXT record at _dmarc.<domain>.

What this validator checks

DMARC records fail silently: receivers that cannot parse your record simply ignore it, and you lose the protection you thought you had. This validator parses the record the way a receiver does. It verifies that v=DMARC1 comes first, that the policy tag p is present with a valid value, and it checks the syntax of every other tag: report addresses in rua/ruf must be mailto: URIs, pct must be 0-100, adkim/aspf only accept r or s, and so on. Unknown or duplicated tags are flagged, since they are the most common typo class.

You can validate a draft record before it ever reaches DNS, or fetch the live record of any domain. For the wider picture (SPF record, DKIM selectors and DMARC together) run the domain through the Email Security Checker.

Reading the verdict

Errors mean receivers will ignore the record or a tag of it; fix them first. Warnings mean the record parses but protects less than it could, the classic cases being p=none left on long after monitoring ended, pct below 100, or a missing rua address so nobody receives the reports.