A published DMARC policy lives as a TXT record at _dmarc.yourdomain.com that starts with v=DMARC1. To check it, query that exact name for TXT records, then read the p= tag (none, quarantine, or reject) and related tags such as rua=, sp=, t=, and alignment modes. A green checker result only proves the record exists in DNS; it does not prove any specific message passed DMARC alignment.
Operators often run a public DMARC checker, see “no record” or “p=none,” and either panic or assume the domain is finished. This guide shows how to perform the DNS lookup yourself, decode the tags, and decide the next step without treating a DNS result as delivery proof.
How we verified the lookup method
We cross-checked the current ArawaMail documentation (Enable Sending, Onboard a Domain, Cloudflare Requirements), the current DMARC specification (RFC 9989, published May 2026), and the primary sender guidance from Google, Yahoo, and Outlook.com. Verification date: 27 October 2026. ArawaMail’s Enable Sending adds DKIM CNAMEs and custom MAIL FROM MX and SPF records (through Cloudflare, or directly for domains registered with ArawaMail). A DMARC record is not among the records it lists, so the DMARC policy stays yours to publish.
Step-by-step: Look up the published _dmarc record
- Take the domain from the visible From address (for example
example.com, ormail.example.comif you send from a subdomain). - Query DNS for a TXT record at exactly
_dmarc.plus that domain. Use dig, nslookup, or any public DNS tool:dig TXT _dmarc.example.com
If a subdomain has no record of its own, receivers walk up the DNS tree to its parent domains (the “DNS Tree Walk” in RFC 9989), so check_dmarc.example.comas well. - Confirm exactly one record starts with
v=DMARC1(it must be the first tag). Other TXT records at that name are ignored, but if twov=DMARC1records come back, receivers discard both and no policy applies. - Parse the tags (semicolon-separated). The most important is
p=.
Public checkers often mix a pure DNS lookup with a sample-message authentication test. This article covers only the DNS record. A DNS result never proves that a given message passed SPF, DKIM, or DMARC.
DMARC policy tags explained
| Tag | What it asks receivers to do | Notes |
|---|---|---|
v=DMARC1 | Identifies a valid DMARC record | Required first tag |
p=none | Monitor only — do not quarantine or reject based on DMARC | Meets the published-record minimum in the Gmail, Yahoo, and Outlook.com bulk-sender rules |
p=quarantine | Treat failing mail as suspicious (often junk) | Enforcement; use after reports show clean legitimate traffic |
p=reject | Reject failing mail | Strongest enforcement; not mandatory for bulk-sender compliance |
sp= | Policy for existing subdomains (falls back to p= if omitted) | See the subdomain authentication guide |
np= | Policy for subdomains that do not exist (falls back to sp=, then p=) | Added to the standard by RFC 9989 |
rua= | Aggregate report destination (mailto: URI) | Reports are XML; read them in the dedicated report guide |
ruf= | Forensic / failure report destination | Rarely used; privacy and volume concerns |
adkim / aspf | Alignment mode (r=relaxed or s=strict) | Relaxed is common; alignment is explained separately |
t= | Test mode: t=y asks receivers to apply one level below the published policy (reject is handled as quarantine, quarantine as none); default t=n | Added by RFC 9989; reports are still generated |
pct= | Old percentage-sampling tag | Historic: removed in RFC 9989. Receivers may ignore it, so do not rely on it for a gradual rollout; use t=y instead |
Three common checker outcomes and what they mean
Record missing
No TXT at _dmarc.example.com starting with v=DMARC1. Publish at least v=DMARC1; p=none; rua=mailto:[email protected] before scaling volume. ArawaMail does not write this record for you — add it yourself in Cloudflare (or your DNS host). See the ArawaMail DNS records reference.
Record present but p=none (or policy exists, mail still fails)
The policy is published, so the “record exists” requirement is met. Failures most often come from missing alignment between the visible From domain and the domains that passed SPF or DKIM. Read DMARC alignment and then how to read a DMARC report.
Record enforcing (quarantine or reject)
Receivers are asked to treat unaligned mail as junk or reject it. This is stronger than the minimum bulk-sender requirement. Only move here after aggregate reports show legitimate sources consistently pass.
Do you need p=reject to satisfy Gmail and Yahoo in 2026?
No. Google’s Email sender guidelines require senders of 5,000 or more messages a day to personal Gmail accounts to set up SPF, DKIM, and DMARC, and state that the DMARC enforcement policy can be set to none. Yahoo asks bulk senders for a valid DMARC policy with at least p=none, and Outlook.com has applied the same p=none minimum to domains sending more than 5,000 messages a day since May 2025. All three also require the From domain to align with the SPF or DKIM domain. See the full Gmail and Yahoo bulk-sender requirements for the complete table.
Google and Yahoo also ask bulk senders to keep reported spam rates below 0.3% (Google recommends staying under 0.1%) and to support one-click unsubscribe (RFC 8058) for marketing and subscribed mail. Those are separate from the DNS policy check.
ArawaMail and DMARC
When you Enable Sending, ArawaMail adds DKIM CNAMEs and custom MAIL FROM MX and SPF records (through Cloudflare, or directly for domains registered with ArawaMail). The documentation does not list a _dmarc TXT among those records. After activation, publish your own DMARC record (start with p=none plus rua=) and verify it with the DMARC Checker in the ArawaMail free email tools. Then review reports before any enforcement.
Related guides: SPF, DKIM, and DMARC explained, authentication on subdomains, how to check DKIM status, and free SPF, DKIM, and DMARC checks.
FAQ
Where is the DMARC record published?
At _dmarc.<organizational-domain> as a TXT record starting with v=DMARC1.
What does p=none actually mean?
It expresses no handling preference, so receivers take no DMARC-based action on failures (monitor only). The record still enables reporting and meets the published-policy minimum for bulk senders at Gmail, Yahoo, and Outlook.com.
Does a green DMARC checker mean mail will pass DMARC?
No. It only confirms the DNS record exists and is syntactically valid. Message-level pass/fail depends on SPF/DKIM alignment and is visible in Authentication-Results headers or aggregate reports.
What is rua= for?
It requests aggregate XML reports. Read those reports in the dedicated guide rather than treating the tag itself as the analysis step.
Do I need p=reject for Gmail/Yahoo compliance?
No. p=none is enough for the published-record requirement. Enforcement is optional and should follow clean reports.
Is pct= still valid?
RFC 9989 moved pct= to historic status. A record that still carries it is not broken, but receivers may ignore the tag. Use t=y while testing a stricter policy, then remove it.
Run the free DMARC Checker at ArawaMail free email tools to confirm the record after you publish it, then move on to report reading and alignment.