How to Check a DMARC Record (Online, nslookup, Gmail & Office 365)

DMARC is the DNS record that tells Gmail, Outlook and every other mail server what to do with a message that claims to come from your domain but fails authentication. Checking it takes less than a minute, and it is the fastest way to find out whether someone could send email in your name.

This guide covers every practical way to check a DMARC record — online, from the command line, from inside an email and for Microsoft 365 domains — and how to read what you find. If you want the background first, read SPF vs DKIM vs DMARC explained.

Method 1: Check your DMARC record online

The quickest option is the free SPF DKIM DMARC Checker. Type the bare domain (example.com, without https://) and it queries the live TXT record at _dmarc.example.com, shows the policy, checks SPF and DKIM alongside it, and grades the result from A to F.

1. Open the checker and enter your domain.
2. Read the DMARC card: Pass, Warning or Fail.
3. If the record is missing or weak, copy the suggested record — the checker works as a simple DMARC record generator.
4. Add it at your DNS host, wait a few minutes, and scan again.

Method 2: Check a DMARC record with nslookup

nslookup ships with Windows, macOS and most Linux systems. Open a terminal or Command Prompt and run:

nslookup -type=txt _dmarc.example.com

If a record exists, the answer contains a line beginning with v=DMARC1. If you see "Non-existent domain" or no TXT answer, the domain has no DMARC record. On macOS or Linux, dig gives cleaner output: dig txt _dmarc.example.com +short.

You can also query the underlying DNS directly with the DNS Lookup tool by choosing the TXT record type and entering _dmarc.example.com.

Method 3: Check DMARC inside a received email

Checking the record tells you what is published; checking a message tells you whether it actually passed. In Gmail, open the message, click the three-dot menu and choose Show original. The summary at the top lists SPF, DKIM and DMARC as PASS or FAIL.

In Outlook, open the message and view its source or message headers, then find the Authentication-Results line. It contains dmarc=pass or dmarc=fail along with the policy that was applied.

How to check a DMARC record for Office 365 / Microsoft 365

Microsoft 365 protects its own onmicrosoft.com domains, but it does not create a DMARC record for your custom domain. Many businesses assume it is handled and find nothing when they check.

1. Scan your custom domain with the checker or run nslookup against _dmarc.yourdomain.com.
2. If it is missing, sign in to your DNS host (not the Microsoft admin centre, unless Microsoft hosts your DNS).
3. Add a TXT record with the host name _dmarc and a value such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
4. Make sure SPF includes spf.protection.outlook.com and that DKIM is enabled in the Microsoft Defender portal.
5. Scan again after propagation, then tighten the policy once reports show your real senders pass.

How to read a DMARC record

A typical record looks like this: v=DMARC1; p=quarantine; pct=100; rua=mailto:reports@example.com; adkim=s; aspf=s. Each tag means:

• v=DMARC1 — the version. Required, and must come first.
• p= — the policy for failing mail: none (monitor), quarantine (send to spam) or reject (block).
• rua= — where aggregate reports are sent. Without it you are flying blind.
• pct= — the percentage of failing mail the policy applies to, useful for a gradual rollout.
• adkim= and aspf= — alignment strictness: r (relaxed, the default) or s (strict).
• sp= — an optional separate policy for subdomains.

Common DMARC problems you will spot when checking

• Two DMARC records on the same name — receivers treat that as no record at all. Merge them into one.
• Record published at the root domain instead of _dmarc — it will never be found.
• Stuck at p=none for months — you get reports but spoofed mail is still delivered.
• Typos such as v=DMARC 1 or a missing semicolon between tags.
• A rua address on a different domain without the required authorisation record.

What to do after checking

If your record is missing, publish a p=none record with a rua address today; it cannot break delivery. Review the reports for two to four weeks, make sure every service that sends as you — newsletter tools, CRMs, invoicing apps — passes SPF or DKIM, then move to p=quarantine and finally p=reject.

While you are auditing your domain's security, it is also worth confirming your website certificate with the SSL Checker and reading what phishing is and how to avoid it, since DMARC is ultimately an anti-phishing control.