Most spoofing of a domain is stopped not by SPF or DKIM alone, but by DMARC, the policy that tells receivers what to do when the visible From address cannot be authenticated. Yet many domains have no DMARC record, sit at p=none for years, or send reports to an external service that never receives them because the authorization record is missing. Gmail and Yahoo also require a DMARC record for bulk senders.
The DMARC Lookup reads the record at _dmarc.<domain>, falls back to parent domains when a subdomain has none, explains every tag, and checks that external report destinations have authorized receiving your reports. Use it when you start a DMARC project, before tightening the policy, or when reports stop arriving.
What is DMARC?
In simple terms
DMARC (Domain-based Message Authentication, Reporting and Conformance) connects the address people see in the From line with the technical checks. It says: "a message claiming to be from my domain must pass SPF or DKIM for my domain; if it does not, do this with it, and send me a report." That closes the gap where a spammer passes SPF with their own domain while showing yours in the From header.
Technical background
DMARC is specified in RFC 7489. The record is published as TXT at _dmarc.<domain> and consists of tag=value pairs separated by semicolons:
| Tag | Meaning |
|---|---|
v=DMARC1 | Version; must be the first tag |
p= | Policy for the domain: none, quarantine or reject (required) |
sp= | Policy for subdomains |
pct= | Percentage of failing mail the policy applies to (default 100) |
rua= | Aggregate report destinations (mailto: URIs) |
ruf= | Failure report destinations |
adkim= / aspf= | DKIM / SPF alignment mode: r relaxed (default) or s strict |
fo= | Failure reporting options |
rf= / ri= | Failure report format / aggregate report interval in seconds |
Alignment means the domain authenticated by SPF (envelope sender) or DKIM (d=) matches the From domain. Relaxed alignment accepts the same organizational domain (mail.example.com aligns with example.com); strict requires an exact match. DMARC passes if at least one aligned mechanism passes.
If a subdomain has no own record, receivers look up the organizational domain's record and apply sp= (or p=). When reports go to a different domain, that domain must publish <sender-domain>._report._dmarc.<report-domain> with v=DMARC1 (RFC 7489 section 7.1).
Command-line equivalent: dig TXT _dmarc.example.com +short.
Why use a DMARC lookup?
- Check that a policy exists and is syntactically valid.
- Understand the effective policy for a subdomain that inherits from its parent.
- Find missing reports: no
rua=, invalid URIs or unauthorized external destinations. - Plan enforcement: see the current
p=,sp=andpct=before changing them. - Meet bulk-sender requirements of large mailbox providers.
Who should use it?
- Domain owners and mail administrators running a DMARC rollout.
- Security teams responsible for brand and phishing protection.
- Marketing operations teams that must meet mailbox provider sender requirements.
- MSPs and consultants auditing customer domains.
How DMARC lookup works
When a message arrives, the receiver extracts the From domain, queries _dmarc.<from-domain> (falling back to the organizational domain), evaluates SPF and DKIM alignment and applies the policy. The NetTools.tech DMARC Lookup performs the DNS and policy analysis part:
- The domain is validated (public names only).
- The NetTools.tech server queries
_dmarc.<domain>via the public resolvers 1.1.1.1 and 8.8.8.8 and keeps TXT records starting withv=DMARC1. - If none is found, it walks up the parent domains (up to three levels, stopping at two labels) and uses the first record found. This approximates the organizational domain without a public suffix list.
- The tags are parsed and checked:
v=DMARC1first, a validp=,pct=, presence ofrua=, and that everyrua/rufentry is amailto:URI. - Report domains outside the checked domain's own tree are collected. For up to five of them, the server queries
<record-domain>._report._dmarc.<report-domain>to see whether they authorize your reports. - A resolver failure or timeout is reported as an error, never as "no record".
The operation has a 15-second limit and normal per-client rate limits.
How to use the NetTools.tech DMARC Lookup
- Open DMARC Lookup.
- Enter the From domain in Domain, for example
example.com(not_dmarc.example.com; the prefix is added for you). - Press Run DMARC Lookup.
- Read the Record and Found at rows, the findings, the Tags table with meanings and, if present, the external report domain table.
- Use Copy, or Open in terminal to run
/dmarc example.comin the web terminal.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| Record | The DMARC TXT record | Typos, missing semicolons |
| Found at | _dmarc.<domain> where it was found | A parent domain means the subdomain inherits |
| "has no own record; the policy of … applies" (info) | Fallback to a parent | Whether sp= gives the intended subdomain policy |
| "p=reject / p=quarantine" (pass) | Enforcing policy | — |
| "p=none: monitoring only" (warning) | No enforcement | Plan the move to quarantine/reject |
| "No DMARC record" (error) | Nothing at the domain or its parents | Publish at least v=DMARC1; p=none; rua=… |
| "N DMARC records found" (error) | More than one record | Receivers then ignore DMARC; keep one |
| "must start with v=DMARC1" (error) | Wrong or misplaced version tag | v=DMARC1 must be first |
| "required p= tag is missing" / "Unknown policy" (error) | Invalid policy | Use none, quarantine or reject |
| "pct=N" (info) | Policy applies to N% of failing mail | Raise to 100 when ready |
| "No rua= address" (warning) | No aggregate reports | Add a mailbox or report service |
| "is not a mailto: URI" (error) | Invalid report destination | Prefix addresses with mailto: |
| "Reports to … are not authorized" (error) | External domain lacks the authorization record | The report service must publish it |
| Tags table | Each tag, value and its meaning | Unknown tags are labeled as such |
| External report domain / Authorized | yes, NO, or "could not check" | NO means reports are not delivered |
Example: a monitoring policy with an external report service
Illustrative result for a hypothetical domain example.com that sends reports to a service at example.net:
| Field | Value |
|---|---|
| Record | v=DMARC1; p=none; rua=mailto:[email protected],mailto:[email protected]; adkim=r; aspf=r |
| Found at | _dmarc.example.com |
Findings:
- Warning: "p=none: monitoring only — failing mail is still delivered. Move to quarantine or reject once reports look clean."
- Error: "Reports to example.net are not authorized: example.net must publish example.com._report._dmarc.example.net (RFC 7489 §7.1). Receivers will not send them."
Tags table rows include p | none | Policy for the domain and rua | mailto:[email protected],mailto:[email protected] | Aggregate report destinations. The external table shows example.net | NO.
What to do: ask the report service to publish example.com._report._dmarc.example.net TXT "v=DMARC1" (most services do this automatically once you register the domain), then run the lookup again. Once reports confirm that all legitimate senders align, change p=none to p=quarantine. The DMARC Record Generator helps build the new record.
Common use cases
- Starting a DMARC project: check what exists today.
- Verifying a newly published record and its report destinations.
- Checking the effective policy of subdomains used for marketing or transactional mail.
- Preparing for bulk-sender requirements, together with the Email Provider Compliance Check.
- Reviewing customer domains as part of an Email Health Check.
Troubleshooting
"No DMARC record" although I published one
Check the host name: it must be _dmarc under the domain, and some DNS panels append the zone automatically, creating _dmarc.example.com.example.com. The record must start with v=DMARC1. If you just published it, the public resolvers may still cache the old negative answer.
Aggregate reports never arrive
Confirm rua= uses mailto: and a working mailbox. If the address is in another domain, check the external authorization row. Large receivers send reports once a day, so wait at least 24 to 48 hours after publishing.
Subdomain mail is rejected unexpectedly
The subdomain has no own record and inherits the parent's p=reject (or sp=reject). Either authenticate that subdomain's senders properly or publish a separate record for it.
DMARC fails although SPF and DKIM pass
They pass for a different domain. Look at the Authentication-Results of a real message with the Email Header Analyzer: smtp.mailfrom and header.d must align with header.from.
Common mistakes
- Publishing
p=rejectbefore reading any reports. - Leaving
p=noneindefinitely and believing the domain is protected. - Two DMARC records, for example one from a vendor wizard and one from the old setup.
- Using plain addresses in
rua=withoutmailto:. - Forgetting that
sp=controls subdomains, including ones attackers invent. - Expecting
ruf=failure reports from every receiver; many do not send them.
Limitations
- The organizational-domain fallback is an approximation that walks parent labels without a public suffix list; for domains under multi-label suffixes it may look one level too high.
- The tool reads the policy; it does not evaluate DMARC for a specific message. Use message headers for that.
- External report authorization is checked for at most five domains.
- Tag values such as
fo=,rf=andri=are listed with their meaning but not deeply validated. - DNS answers come from 1.1.1.1 and 8.8.8.8 and may be cached.
Security & privacy
The domain is sent to the NetTools.tech server, which queries public resolvers. Only public names are accepted, results are not stored, and the tool log keeps the tool name, the domain and your shortened IP address for 30 days (see the privacy policy). The lookup needs only the public domain name; DMARC reports themselves may contain personal data and are not processed by this tool.
Related tools
- DMARC Record Generator – build a record step by step (guide).
- SPF Lookup – check the SPF part of alignment (guide).
- DKIM Lookup – check the DKIM key (guide).
- Email Header Analyzer – see real DMARC results and aligned domains (guide).
- Email Health Check – DMARC with the other core checks (guide).
- Email Tools overview – workflows across all email tools.
Summary
DMARC turns SPF and DKIM into protection for the visible From address and gives you reports about who sends mail as your domain. The NetTools.tech DMARC Lookup shows the effective record, including fallback to a parent domain, explains every tag, and catches missing reports and unauthorized external destinations. Move from p=none to enforcement only after the reports confirm that every legitimate source aligns.
Frequently asked questions
What is a DMARC record?
A DMARC record is a TXT record at _dmarc.<domain> starting with v=DMARC1. It tells receivers what to do with mail whose visible From domain fails authentication (p=none, quarantine or reject) and where to send aggregate and failure reports.
Which DMARC policy should I use?
Start with p=none and an rua= address, read the aggregate reports, and fix every legitimate source that fails. Then move to p=quarantine and finally p=reject; pct= can apply the stricter policy to part of the failing mail during the transition.
Why do I need SPF or DKIM alignment?
DMARC passes only if SPF or DKIM passes for a domain that matches the visible From domain. SPF can pass for a provider's bounce domain and DKIM can pass for the provider's own d= domain, and neither counts for DMARC unless it aligns with your From domain.
What is the difference between rua and ruf?
rua= receives aggregate reports: daily XML summaries of which IPs sent mail as your domain and whether they passed. ruf= requests failure (forensic) reports about individual messages, which many large receivers do not send for privacy reasons.
Can DMARC reports go to another domain?
Yes, but the receiving domain must publish an authorization record at <your-domain>._report._dmarc.<their-domain> containing v=DMARC1. Without it receivers skip the address; the NetTools.tech lookup checks this for up to five external report domains.
Does a subdomain need its own DMARC record?
Not necessarily. If a subdomain has no record, receivers use the organizational domain's record, applying sp= if it is set and p= otherwise. The lookup shows where the record was found when it falls back to a parent domain.
Why does the lookup warn about p=none?
p=none is monitoring only: receivers send reports but still deliver mail that fails DMARC, so spoofing is not blocked. It is the right starting point, but it should not stay that way once reports show your legitimate sources pass.