How to Check and Test Your DMARC Record

You have created your DMARC record and added it to your DNS. But how do you know it is actually working? A typo in the record, a wrong DNS host name, or a propagation delay can all leave your domain unprotected without any obvious sign that something is wrong.

Testing your DMARC record after publishing is not optional — it is the step that confirms everything is in place. This guide covers every way to check your record, what to look for in the results, and how to troubleshoot the most common issues.

Check Your Record with an Online Tool

The fastest way to verify your DMARC record is to use an online lookup tool. Enter your domain and the tool queries DNS, retrieves your record, and highlights any issues.

A good DMARC checker will tell you more than just whether the record exists. It should validate the syntax, confirm the tag values are valid, and warn you about common misconfigurations.

Check Your Record from the Command Line

If you prefer using the terminal, or if you want to confirm what a specific DNS resolver sees, you can query your DMARC record directly.

Using nslookup (Windows)

Open Command Prompt or PowerShell and run:

nslookup -type=TXT _dmarc.yourdomain.com

This will return all TXT records at that subdomain. You should see your DMARC record in the output, starting with v=DMARC1.

Using dig (macOS / Linux)

Open Terminal and run:

dig TXT _dmarc.yourdomain.com +short

The +short flag gives you just the record content without the extra DNS response metadata. The output should show your full DMARC record in quotes.

Querying a Specific DNS Server

To check what a particular resolver sees (useful for debugging propagation), you can specify the server:

nslookup -type=TXT _dmarc.yourdomain.com 8.8.8.8

dig TXT _dmarc.yourdomain.com @8.8.8.8 +short

Both commands query Google's public DNS (8.8.8.8). You can also try Cloudflare's resolver at 1.1.1.1 or your ISP's resolver to see whether your record has propagated to different parts of the internet.

What a Healthy DMARC Record Looks Like

When you check your record, here is what you want to see:

A single TXT record at _dmarc.yourdomain.com. There should be exactly one DMARC record. Multiple records cause unpredictable behavior.

Starts with v=DMARC1. This must be the very first tag. If anything comes before it, the record is invalid.

Has a valid p tag. The policy must be none, quarantine, or reject. Any other value makes the record invalid.

Includes a rua tag. Without this, you get no reports and no visibility. A healthy record always includes at least one reporting address.

All tags use valid values. Tags like adkim, aspf, and fo each have specific allowed values. An invalid value may cause the entire record to be ignored.

Here is an example of a well-formed record:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:forensics@yourdomain.com; pct=100; fo=1;

What an Unhealthy DMARC Record Looks Like

These are the red flags to watch for when checking your record.

No record found. The most basic problem. Either you have not created a record, it is at the wrong DNS location, or propagation is not complete.

Multiple DMARC records. If your DNS has two or more TXT records at _dmarc.yourdomain.com, receiving servers may ignore both, use one unpredictably, or return errors. Delete the extras so only one remains.

Missing v=DMARC1 at the start. If the version tag is not the very first tag, the record is invalid. Some people accidentally put p=none first — that breaks the record entirely.

Invalid tag values. Common mistakes include p=monitor (not a valid policy — use p=none), pct=50% (the percent sign is not valid — just use 50), or adkim=relaxed (use r, not the full word).

Spaces inside values. Writing p= none instead of p=none can cause parsing failures. Tags should have no spaces around the equals sign.

Missing semicolons. Tags must be separated by semicolons. Forgetting one between tags may cause everything after the missing semicolon to be ignored.

DNS Propagation: How Long to Wait

After adding or updating your DMARC record, you need to wait for DNS propagation before the change is visible everywhere.

Typical propagation time: Most changes appear within five to thirty minutes. Your DNS provider usually updates immediately, and major resolvers like Google (8.8.8.8) and Cloudflare (1.1.1.1) pick up changes quickly.

Maximum propagation time: In rare cases, it can take up to 48 hours. This usually happens when the previous record had a high TTL (time to live) value, causing resolvers to cache the old record longer.

How to check propagation:

Ongoing Validation

Checking your DMARC record is not a one-time task. Records can break without warning due to accidental DNS changes, provider migrations, or expired configurations. Here are the situations where you should recheck:

After any DNS change. If you switch DNS providers, update nameservers, or modify other records, verify your DMARC record survived the change.

After updating your DMARC policy. Every time you move from p=none to p=quarantine, increase the pct value, or move to p=reject, check that the new record is live and syntactically valid.

After changing email services. If you add a new marketing platform, switch CRMs, or change transactional email providers, check that your authentication records (SPF, DKIM, and DMARC) are still correct. New services may require updates to your SPF record or DKIM configuration. Understanding how SPF, DKIM, and DMARC work together helps you know which records to verify after each change.

Periodically as routine maintenance. Even if nothing has changed, checking your records quarterly catches issues like expired DKIM keys or accidental deletions before they affect your email delivery.

The best approach is automated monitoring that checks your records daily and alerts you when something changes. That way you do not have to remember to check manually. Agencies managing records for multiple clients should make automated DMARC checking part of their standard client onboarding process.

Monitor Your DMARC Record

You've created your DMARC record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.