Free DMARC Checker
Enter a domain to read its DMARC record from DNS, see the policy receivers will apply to mail that fails authentication, and find the settings that leave it open to spoofing.
Reading _dmarc...
Could not check
No DMARC record is published for this domain.
Nothing to fix in this record.
What a DMARC Checker Tells You
A DMARC checker looks up the TXT record at _dmarc.yourdomain.com and reads what it tells receiving mail servers to do with a message that claims to be from you but fails SPF and DKIM alignment: deliver it anyway, send it to spam, or reject it.
Having a DMARC record is not the same as being protected. A policy of p=none, an open subdomain policy, a partial pct or a second record at the same name all pass a "do you have DMARC" check while spoofed mail still gets through. This checker grades the record the way our monitoring engine does, so those cases are named. For SPF, DKIM and MX in the same pass, use the email deliverability checker.
- Enter the domain that appears in your From address, without "www".
- We read the TXT record at _dmarc for that domain from DNS.
- Read the verdict: enforced, monitoring only, partly applied or missing.
- Fix what is flagged, publish the change, then check again once it has propagated.
What this check settles
- Whether spoofed mail is blocked: only p=quarantine or p=reject, applied to 100% of mail, tells receivers to act on a forgery.
- Whether subdomains are covered: an sp=none under a strict apex policy leaves every subdomain open.
- Whether anyone is watching: without an rua address you get no reports on who is sending as your domain.
DMARC Policies Explained
The p= tag is the whole decision. Here is what each value asks receivers to do with mail that fails authentication.
| Policy | What receivers do | What it means | Protection |
|---|---|---|---|
| p=none | Deliver it | Monitoring only. Failing mail is delivered as normal, and reports are sent to the rua address. Use it to find every legitimate sender before tightening. | None |
| p=quarantine | Send it to spam | Failing mail is treated as suspicious, usually delivered to the spam folder. Spoofed mail no longer reaches the inbox. | Strong |
| p=reject | Refuse it | Failing mail is refused during delivery and never reaches the recipient. The goal state for any domain that sends mail, and for any domain that sends none. | Strongest |
How to Read the Result
The verdict comes first, then the record itself and every tag it sets.
The verdict
The headlineWhether the record actually tells receivers to act on a spoofed message. Enforced means quarantine or reject applied to all failing mail; monitoring only, partly enforced and not applied all mean spoofed mail can still be delivered.
The raw record
The sourceThe TXT record exactly as published at _dmarc. If two records come back, the domain has the duplicate-record failure, and receivers ignore both.
Each tag
The settingsThe policy, the subdomain policy (which inherits p when not set), the share of mail it applies to, where reports go, and how strictly SPF and DKIM must align with the From domain.
How email auth worksWhat to fix
The fixesEach gap the engine found, in order of severity, with the change that closes it. The same findings power our DMARC monitoring alerts.
What a DMARC Record Looks Like
A DMARC record is a single TXT record published at _dmarc under the domain, made of tag=value pairs separated by semicolons. It always starts with v=DMARC1, and the only other required tag is the policy, p.
A typical enforced record reads v=DMARC1; p=reject; rua=mailto:[email protected]: reject failing mail, and send daily aggregate reports to that address.
How to Roll Out DMARC Safely
Moving straight to reject can block your own mail if a sending service is not yet covered by SPF or signing with DKIM. The safe path takes a few weeks.
The usual sequence:
- Publish p=none with an rua address and read the reports for every service sending as you.
- Fix SPF and DKIM for each legitimate sender until the reports show them passing.
- Move to p=quarantine, optionally with a pct below 100 at first, then raise it to 100.
- Move to p=reject, and keep monitoring the record so it stays there.
Where DMARC Records Go Wrong
Most DMARC failures are records that exist and do nothing. The common ones:
- Two records at _dmarc, often an old one left behind when a new provider adds its own. The standard tells receivers to apply neither, so the domain is unprotected while it looks configured.
- sp=none under p=reject, which protects the apex and leaves every subdomain open. Attackers simply send from a subdomain. Remove sp and the apex policy applies to both.
- A pct below 100 left in place after a rollout, so a share of spoofed mail is still delivered as if there were no policy.
- Publishing at the wrong name, such as a TXT record on the apex instead of _dmarc. A DNS lookup shows where the record actually sits.
Why DMARC Matters
Stop exact-domain spoofing
Without an enforced policy, anyone can send mail with your exact domain in the From line, and receivers have no instruction to stop it.
Meet bulk-sender rules
Major mailbox providers require bulk senders to publish DMARC. Without it, your own campaigns are more likely to be filtered or refused.
See who sends as you
Aggregate reports list every server sending mail as your domain, which is how you find forgotten services and active abuse.
Protect domains that send nothing
A parked or redirect-only domain with p=reject cannot be used to spoof you. Without one, it is the easiest name in your portfolio to abuse.
Who Checks DMARC Records
The same record read answers a different question depending on who runs it.
IT & Email Admins
Confirm the policy after onboarding a new sending service, and before tightening from none to quarantine or reject.
For DNS monitoringSecurity Teams
Audit the anti-spoofing posture of every domain you are responsible for, parked ones included.
For IT & MSPsEmail Marketers
Check the sending domain meets mailbox providers' DMARC requirement before a campaign goes out.
For marketersAgencies
Audit a client's DMARC record and keep it under monitoring so a provider change does not weaken it.
For agenciesRelated Email & DNS Tools
DMARC depends on SPF and DKIM. These pick up the rest.
Check SPF, DKIM and MX
Read the whole mail setup in one pass, so you know whether your legitimate mail will pass the policy you set.
Email deliverability checkerMonitor DMARC
Get alerted when the policy weakens, a second record appears or reporting is removed.
Email auth monitoringCheck propagation
Just published a new policy? Confirm every resolver sees it before you rely on it.
Check propagationFull DNS lookup
See every record in the zone when a DMARC record is not being read the way you expect.
Run a DNS lookupFrequently Asked Questions
Common questions about DMARC records, policies and how to check them.
How do I check my DMARC record?
Enter your domain in the checker above. It reads the TXT record at _dmarc under your domain, shows it exactly as published, and explains each tag and whether the policy is enforced. You can also query the record yourself with any DNS lookup tool by asking for the TXT record at _dmarc.yourdomain.com.
What is a DMARC record?
A TXT record at _dmarc under your domain that tells receiving mail servers what to do with a message claiming to come from you but failing SPF and DKIM alignment: deliver it (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It can also ask receivers to send you reports.
Is p=none safe?
It is safe for your own mail, because it changes nothing about delivery, and that is also the problem: spoofed mail is still delivered. Use p=none to gather reports while you fix SPF and DKIM, then move to quarantine and reject.
What is the difference between quarantine and reject?
Quarantine asks receivers to treat failing mail as suspicious, which usually means the spam folder. Reject asks them to refuse it during delivery, so it never arrives. Both stop spoofed mail reaching the inbox; reject is the stronger and the usual end goal.
What does sp mean in a DMARC record?
The subdomain policy. It sets what happens to failing mail from subdomains such as mail.example.com. When sp is not set, subdomains inherit the main p policy, which is usually what you want. Setting sp=none under p=reject leaves every subdomain open to spoofing.
What does pct do?
It applies the policy to only that percentage of failing mail; the rest is treated as if the policy were none. It is useful for a gradual rollout and should end at 100, which is also the default when pct is not set.
Why does having two DMARC records break it?
The standard says that when more than one DMARC record is found, receivers must apply none of them. A second record, often left behind by a previous provider, leaves the domain unprotected while both records look valid. Keep exactly one.
What are rua and ruf?
Reporting addresses. rua receives aggregate reports, daily summaries of which servers sent mail as your domain and whether it passed. ruf receives failure reports about individual messages, which many providers no longer send. rua is the one to set.
Do I need DMARC on a domain that sends no email?
Yes. A domain that sends nothing is easy to spoof precisely because nobody watches it. Publish p=reject on it, alongside an SPF record of v=spf1 -all, and it cannot be used to send mail as you.
I changed my DMARC record. Why does the checker show the old one?
DNS caches the old record until its TTL expires. Check that the change has propagated across resolvers, and look for a second record at _dmarc that may still be published alongside the new one.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.