DMARC checker: is your domain protected?
Look up your DMARC record, check the policy, reporting and alignment, and get the exact record to publish next, along with SPF, DKIM and more.
- Free, no sign-up
- Results in seconds
- 8 standards checked
- Email yourself the report
The policy that stops forged email.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a single TXT record at _dmarc.yourdomain.com. It tells receiving mail servers what to do with a message that claims to come from you but fails SPF and DKIM: deliver it, send it to spam, or reject it.
It also asks those servers to send you daily reports, so you can see every service sending email as your domain, legitimate or not. That visibility is what makes it safe to turn enforcement on.
DMARC tags, explained.
- v=DMARC1Required, and must come first. Identifies the record as DMARC.
- p=none | quarantine | rejectRequired. What to do with failing mail: monitor only, send to spam, or refuse it.
- rua=mailto:…Where daily aggregate reports go. Without it you're flying blind.
- sp=Policy for subdomains. If it's weaker than p, attackers spoof billing.yourdomain.com instead.
- pct=Percentage of failing mail the policy applies to, for gradual rollouts. Should end at 100.
- adkim= and aspf=Alignment mode: r (relaxed, the default) or s (strict, exact domain match).
- ruf=Forensic (failure) reports. Few providers send them; optional.
- fo=When to generate failure reports. fo=1 reports any failure.
The safe path to p=reject.
Monitor: p=none
Publish p=none with a rua address. Nothing changes for your mail, but reports start arriving.
Fix your senders
Use the reports to authenticate every legitimate service: Microsoft 365, your CRM, newsletter tool, website forms.
Quarantine
Move to p=quarantine (optionally with pct=25, then 50, then 100). Forged mail goes to spam.
Reject
Finish at p=reject. Forged mail is refused outright, and your domain qualifies for BIMI.
What we see most often.
- Stuck at p=none foreverMonitoring mode protects nobody. It's meant to last weeks, not years.
- Two DMARC recordsReceivers ignore DMARC entirely when there's more than one record.
- Reports sent to another domain without permissionThe receiving domain must publish an authorisation record, or many providers won't send the reports.
- Forgetting subdomainssp=none leaves every subdomain open to spoofing even when p=reject.
What is a good DMARC policy?
p=reject with pct=100 and a working rua reporting address. p=quarantine is a solid intermediate step. p=none is only for the initial monitoring phase.
Do I need SPF and DKIM for DMARC to work?
Yes. DMARC passes when either SPF or DKIM passes and aligns with your From domain. Having both makes your mail resilient, because forwarding often breaks SPF.
Where do I publish my DMARC record?
As a TXT record at _dmarc followed by your domain, for example _dmarc.yourcompany.com, in the DNS zone at your DNS host or registrar.
What do I do with DMARC reports?
They arrive as compressed XML, which isn't meant to be read by hand. A DMARC reporting service turns them into a dashboard of who sends as you. We include this in our managed email security service.
Need help getting to p=reject?
We'll read your DMARC reports, authenticate every legitimate sender and move you to enforcement without losing a single genuine email.
Tell us about your IT.
We answer almost every inquiry within one business day.