DMARC checker: does your mail arrive?

Is my DMARC record correct?

Your DMARC record is correct when it is the only one at _dmarc.yourdomain, it carries a policy (p=none, quarantine or reject) and an address for reports, and SPF or DKIM passes for the same domain your customers see as the sender. The DMARC checker reads SPF, DKIM and DMARC from DNS in about ten seconds and answers three questions instead of giving a score: who may send mail for your domain, is your mail signed, and what happens to a forged mail. Below the answers sit the records to paste at your DNS host, with your domain filled in.

For a company that mails customers in several EU countries this matters more than for a local shop. Quotes, order confirmations, reminders and invoices go to Gmail in one country, Outlook in another, a corporate filter in a third. Each of them judges your mail by the same three records, and since 2024 the large providers ask for all three from anyone sending at volume.

What Gmail, Yahoo and Microsoft require

Few small companies send 5,000 mails a day, but a newsletter of a few thousand addresses counts towards your domain, and the rules for every sender apply to all of your mail. With SPF, DKIM and DMARC in order you meet all three providers. A new DMARC standard, RFC 9989, was published in May 2026; existing records keep working, only the pct tag goes away.

One record, several sending services

Most companies send through more than one service: a mailbox on Microsoft 365 or Google Workspace, a newsletter tool, a CRM, an invoicing package, an online shop. Each needs a place in your records.

• SPF holds all of them in one recordA domain has exactly one SPF record; two is an error that makes receivers ignore both. Each service adds an include, and the record may need at most ten DNS lookups in total, counting the includes inside includes. Microsoft 365, Mailchimp, a CRM and a helpdesk tool can reach that limit quickly.
• DKIM per serviceEach service signs with its own key under its own selector: selector1 and selector2 for Microsoft 365, google for Google Workspace, s1 and s2 for SendGrid. Turn it on in each service's settings with your own domain, not the service's.
• Alignment is where a second tool breaksA newsletter tool often sends with its own bounce domain, so SPF passes for that domain, not for yours. DMARC then fails on SPF alignment and depends entirely on DKIM. If DKIM for that tool still signs with the tool's domain, the mail fails DMARC. Signing with your own domain fixes it.

Setting up DMARC in three steps

1. Start with p=none and reports. Publish a TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Nothing changes for your mail, and Gmail, Outlook and Yahoo send you daily reports of who sent mail as your domain.
2. Read the reports for two to four weeks. You will see your own services and sometimes one you forgot: an online shop sending order confirmations, a CRM, an invoicing tool sending reminders. Add them to SPF or turn on DKIM for them.
3. Move to quarantine, then reject. Once all genuine mail passes, set p=quarantine and a few weeks later p=reject. From then on receivers stop forged mail with your address as sender.

Where it goes wrong later

Most errors appear after the start. Moving your domain to another host can leave TXT records behind; read how to transfer a domain name before you move. A new newsletter or invoicing tool sends as your domain without anyone updating SPF. A site under website maintenance keeps track of that, together with the certificate you can check with the SSL checker. What makes a newsletter worth opening is in how to write a newsletter.

Invoice fraud in your name

Fraudsters send mail that looks like it comes from your accounts team, with a new bank account. With DMARC at p=reject, your customer's mail server refuses mail with your address as sender. At p=none it arrives. Agree with customers that bank details never change by email, and print them on the invoice itself. In Belgium, invoices between businesses now travel over Peppol rather than email, which closes that route for the invoice; check a client with the Peppol check and their VAT number with the EU VAT number check.