DMARC Checker and DKIM Lookup

How to Check a DMARC Record

Enter the domain that sends the mail, add a DKIM selector if you want the key checked too, and submit: the checker reads the TXT records from DNS and checks their syntax.

1. Enter the domain that sends the mail, such as example.com. A full URL is reduced to its host name.
2. Optionally, enter a DKIM selector: the s= value of the DKIM-Signature header in a message the domain sent.
3. Select Submit. The checker looks up _dmarc.<domain>, then the nearest parent domains when the domain has no record, and <selector>._domainkey.<domain> when you gave a selector.
4. Read the state of each record (Valid, Invalid, Multiple records, Not found, Revoked or Lookup failed) and the findings listed under it.
5. Correct the TXT record at your DNS host and check again. Resolvers can keep the old record until its TTL expires.

DMARC Record Syntax

A DMARC record is a TXT record that starts with v=DMARC1 and sets a policy in the p tag; the checker reads every tag, reports values RFC 7489 does not allow, and shows the default of the sp, pct, adkim, aspf and fo tags when they are absent.

DMARC Record Example

The record v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@example.com; adkim=s is published as a TXT record at _dmarc.example.com. The v tag must come first and p should follow it; the other tags may appear in any order. Tags are separated by semicolons, and a tag that appears twice makes the whole record invalid.

Policy and Percentage Tags

The p tag asks receivers to do nothing (none), quarantine or reject mail that fails DMARC. The sp tag sets the policy for subdomains and defaults to p, and pct, a whole number from 0 to 100, applies the policy to that share of failing mail. Any other value is reported as an error.

Alignment and Reporting Tags

The adkim and aspf tags accept r (relaxed, the default) or s (strict). The rua and ruf tags hold comma-separated report addresses, each a URI with an optional size limit such as !10m; a value without a scheme or a mailto: without a valid address is an error, and another scheme is a warning, because receivers only have to support mailto:. The fo tag accepts 0, 1, d and s, separated by colons.

No DMARC Record Found

Not found means no TXT record starting with v=DMARC1 exists at _dmarc.<domain> or at the parent domains the checker looked up. Receivers then apply no DMARC policy to mail from the domain, unless the organizational domain is a parent the checker skipped, which the result then says. To start, publish v=DMARC1; p=none with a rua address, read the aggregate reports, then move to quarantine or reject.

Multiple or Invalid DMARC Records

Multiple records means more than one TXT record at the same name starts with v=DMARC1, and receivers then apply no DMARC policy at all. Invalid means the record has a syntax error, such as a missing p tag or a pct above 100. Without a valid p, receivers act as if p=none only when rua holds at least one valid address.

Records Found at a Parent Domain

When a subdomain has no record of its own, receivers use only the record of its organizational domain, through its sp tag, or p when sp is absent. The checker has no public suffix list, so it looks up at most four parent domains, nearest first and ending with the two-label domain, and shows where it found a record and any parent it skipped. It shows the policy that applies only for a record at the domain itself or at the two-label domain; a record at a parent in between is reported as unconfirmed, next to what the two-label domain publishes.

What Does a DKIM Record Look Like?

A DKIM record is a TXT record at <selector>._domainkey.<domain>, such as v=DKIM1; k=rsa; p= followed by the base64 public key that verifies the signatures of the mail.

DKIM Record Tags

The v tag is optional, but when present it must be first and equal DKIM1. The k tag names the key type, rsa by default or ed25519, and p holds the key and is required. The checker also reads h (hash algorithms), s (service type) and t, where the y flag marks a domain that is testing DKIM; tag names are case-sensitive.

DKIM Key Size

The checker decodes the key and shows its size. Under RFC 8301, an RSA key shorter than 1024 bits is an error, because verifiers must not accept signatures made with it, and a key shorter than 2048 bits is a warning. An Ed25519 key must be exactly 32 bytes.

Revoked or Missing DKIM Key

An empty p tag means the key has been revoked, which is how a domain retires an old selector. Not found means there is no TXT record at <selector>._domainkey.<domain>, so check the spelling of the selector.

Frequently Asked Questions About DMARC and DKIM