Free DMARC Record Checker

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record published at _dmarc.yourdomain.com. It tells receiving mail servers what to do with messages that fail SPF or DKIM authentication: deliver them anyway, send them to spam, or reject them outright.

DMARC does not check email on its own. It builds on top of SPF and DKIM, adding a policy layer and an alignment requirement. For DMARC to pass, the authenticated domain from either SPF or DKIM must match the domain in the message's From header. A message can pass SPF and DKIM individually and still fail DMARC if alignment is wrong.

The reporting side is the part most senders ignore. When you add an rua= address, you receive daily aggregate reports from participating mail providers showing which IPs sent mail claiming to be from your domain and whether those messages passed authentication. These reports are the fastest way to find misconfigured sending services or spoofing attempts before they damage your domain reputation.

Common DMARC failures and what they mean

p=none does not protect you. A policy of p=none tells receiving servers to take no action on failing messages. Mail gets delivered whether it passes authentication or not. This mode is useful for monitoring before you enforce a stricter policy, but it does nothing to stop spoofing while it is active.

Alignment failures are the most common cause of DMARC failure. DMARC requires that the domain in either the SPF MAIL FROM (envelope-from) or the DKIM d= tag matches the domain in the message's From header. If you send through a third-party platform that uses their own domain for the envelope-from and does not sign with your domain in DKIM, DMARC will fail even if SPF and DKIM individually pass.

Three common SPF and DKIM failure scenarios:

• SPF passes, DKIM fails: Your envelope-from domain aligns with your From domain, but the DKIM signature is missing or signed with a third-party domain. Common with ESPs that have not configured DKIM signing for your domain.
• DKIM passes, SPF fails: The DKIM signature uses your domain, but the envelope-from is a third-party address. This is the default for Amazon SES without a custom MAIL FROM configured.
• Both fail: Either the sender is not in your DNS records at all, or there is a DNS misconfiguration on your end.

Relaxed vs. strict alignment. DMARC defaults to relaxed alignment for both DKIM and SPF. In relaxed mode, subdomains are allowed to match: if your From domain is company.com and your DKIM signs with mail.company.com, it passes. In strict mode, the domains must match exactly. Leave alignment at the default relaxed unless you have a specific reason to tighten it.

How to fix DMARC issues on Amazon SES

Amazon SES has two default behaviors that cause DMARC alignment failures. Both are fixable with configuration changes in the SES console and your DNS.

Problem 1: SPF alignment fails by default. When SES sends a message, the envelope-from defaults to a subdomain of amazonses.com, something like 0123456789abcdef.us-east-1.amazonses.com. This does not align with your From domain. SPF may pass for amazonses.com, but DMARC requires the SPF-authenticated domain to align with your domain, so DMARC fails.

Fix: Set up a custom MAIL FROM domain. In the SES console, go to Verified Identities, select your domain, and configure the MAIL FROM domain to a subdomain you control, such as bounce.yourdomain.com. SES provides two DNS records to publish: an MX record and an SPF TXT record (v=spf1 include:amazonses.com ~all). Once those are live and SES confirms the status as verified, SPF will align.

Problem 2: DKIM alignment fails without Easy DKIM. By default, SES signs outgoing messages using amazonses.com as the DKIM signing domain. That does not align with your From domain. You need Easy DKIM or BYODKIM so that SES signs with your own domain.

Fix: In the SES console, go to Verified Identities, select your domain, and open the DKIM section. Enable Easy DKIM and choose RSA-2048. SES generates three CNAME records. Publish them in your DNS. Once SES shows the DKIM status as verified, outgoing messages will be signed with your domain and DKIM alignment will pass.

Recommended sequence:

1. Verify your sending domain in SES.
2. Enable Easy DKIM and publish the three CNAME records SES provides.
3. Configure a custom MAIL FROM domain and publish the required MX and SPF records.
4. Add a DMARC record: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
5. After one to two weeks of aggregate reports, confirm all legitimate SES mail is passing. Move to p=quarantine, then p=reject.

Use the DMARC checker above to confirm your record is publishing correctly after DNS changes go live, which typically takes 24 to 48 hours.

How to read your DMARC record

A DMARC record is a semicolon-separated list of tag-value pairs. The tags that matter most for most senders: