What is a DMARC record?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc. . It tells receivers what to do with mail that claims to come from the domain but fails both SPF and DKIM, and where to send reports about that mail.

What do p=none, p=quarantine and p=reject mean?

p=none only asks for reports: failing mail is still delivered. p=quarantine sends failing mail to spam. p=reject tells receivers to refuse it. Start with p=none, read the aggregate reports until every real sender passes, then move to quarantine and reject.

Do Gmail and Yahoo require DMARC?

Yes, for bulk senders. Since February 2024, Gmail and Yahoo require domains that send more than 5,000 messages a day to their users to publish a DMARC record (p=none is enough), and to pass SPF or DKIM for the domain in the From address. Outlook added the same rule for consumer addresses in May 2025.

What are rua and ruf?

rua= lists the addresses that receive aggregate reports: daily XML summaries of who sent mail as your domain and whether it passed. ruf= lists addresses for failure reports about single messages, which few receivers send. Without rua you cannot see which servers send as your domain.

Does a subdomain need its own DMARC record?

No. When mail.example.com has no record, receivers apply the record at _dmarc.example.com, using its sp= tag if it has one and p= otherwise. Our checker shows when a subdomain inherits its policy.

Is there a DMARC API?

Yes. The /api/v1/email-auth endpoint returns the parsed DMARC record with the SPF and DKIM results. See the API documentation for authentication and plan limits.

Check the DMARC record of any domain

Results for

github.com

Full analysis

Email authentication

2 warnings

Warning

SPF: Warning:~all (soft fail), 10 of 10 lookups
DMARC: Pass:p=quarantine
DKIM: Warning:7 keys: google, selector1, k1, k2, k3, s1, s2
MTA-STS: Note:Not set up
TLS reporting: Note:Not set up
BIMI: Note:Not set up
Mail servers: github-com.mail.protection.outlook.com

DMARC record

_dmarc.github.com

Pass

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1

Policy p=quarantine: receivers send mail that fails DMARC to spam.
Aggregate reports go to dmarc@github.com.

Policy: quarantine (send to spam)
Subdomain policy: reject (refuse)
Percentage: 100%
Aggregate reports: dmarc@github.com
Failure reports: dmarc@github.com
DKIM alignment: Relaxed
SPF alignment: Relaxed

SPF record

10 of 10 DNS lookups

Warning

v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all

Uses 10 of 10 DNS lookups. One more include can break SPF.
Ends in ~all (soft fail), so receivers accept mail from unlisted servers but mark it as suspicious.

Includes

9 domains

include:spf.protection.outlook.com1 lookup
include:_netblocks.google.com1 lookup
include:_netblocks2.google.com1 lookup
include:mail.zendesk.com1 lookup
include:_spf.salesforce.com2 lookups
include:servers.mcsv.net1 lookup
include:mktomail.com1 lookup
include:sendgrid.net2 lookups
include:ab.sendgrid.net1 lookup

DKIM keys

24 selectors checked

Warning

google._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSiQlhwIDAQAB
selector1._domainkey.github.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;
k1._domainkey.github.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;
k2._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o9QuQIDAQAB;
k3._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtbNiCY80lHRIlcKx3XDIR7257aUx+q9CSIARdfTL6KCuLGNFx5g9TgVr6png4ajcieSQGtOehBgxnkDN8aAA5TX0FmFrcefJU0JoxLOF09EKgXxhSSHCk/ekVb0PXSboHXoZ9+EI404F1qhcwXXIgHXTaUthHTut2P6BBZhIXIgvDe/w49GchR7MRJqjNb7neEBbYHbgWuBTvvHCg7Gy6m6n9krYK+ROWq3dVvXy9plAGK3ygM+HtjIiMt7arRGMOF0WgDTz7YdN9BGpt6BvXxLnjiQcgS5T9n+cIyPZgiWzDMXNlaEEdKTEKxrwIDAQAB;
s1._domainkey.github.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6UwIDAQAB
s2._domainkey.github.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHwIDAQAB

Selectors we checked (24)

google
selector1
selector2
default
dkim
mail
k1
k2
k3
s1
s2
smtp
mx
mandrill
mxvault
protonmail
protonmail2
fm1
fm2
sig1
zmail
kl
s1024
s2048

To check another selector, enter it as selector._domainkey.github.com.

MTA-STS, TLS reporting and BIMI

Optional records

MTA-STS

Not set up

No MTA-STS record. Sending servers may deliver mail to this domain without TLS when an attacker strips it.

TLS reporting

Not set up

No TLS-RPT record, so nobody hears about failed TLS connections to your mail servers.

BIMI

Not set up

No BIMI record, so inboxes that support it show no brand logo next to your mail.

Run this lookup from code

The API returns this result as JSON. The free plan includes 100 API calls per month.

curl "https://hostingchecker.online/api/v1/email-auth?query=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

Get a free API key Read the API docs

View full analysis

How it works

How DMARC works

DMARC builds on SPF and DKIM. A message passes DMARC when SPF passes for a Return-Path domain that matches the visible From domain, or when a DKIM signature verifies for a matching domain. Matching is called alignment: relaxed alignment accepts a subdomain, strict alignment needs the exact domain.

The record also asks receivers for reports. Aggregate reports show every server that sent mail as your domain, so you can find forgotten senders before you tighten the policy to quarantine or reject.

p: Policy for failing mail: none, quarantine or reject
sp: Policy for subdomains, defaults to p
pct: Share of failing mail the policy applies to
rua: Where receivers send aggregate reports
adkim / aspf: Relaxed (r) or strict (s) alignment

FAQ

DMARC checker FAQ

Common questions about DMARC policies and reports.

Related guides

Learn more from the blog

Step-by-step guides on reading and using these results.

Related tools

More free tools

Explore our other free lookup and analysis tools.

Free lookup tool