Back to all free tools

DMARC Checker

Validate the DMARC record with tag-by-tag explanation and warnings.

Result

No result yet

Enter the inputs above and press Run. Results appear here in a moment.

Monitor this 24/7 — get alerts on the first failure.

Start free

Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our Terms.

What is DMARC Checker?

DMARC (Domain-based Message Authentication, Reporting, and Conformance — RFC 7489) is the policy layer that sits on top of SPF and DKIM. It tells receivers what to do when those checks fail and where to send reports about your domain's mail traffic. Without DMARC, SPF and DKIM are signals receivers can choose to act on; with DMARC at enforcement, they're rules receivers must follow.

This tool fetches _dmarc.<domain> from DNS, parses every tag, and tells you exactly what policy will be applied: monitor-only, quarantine, or reject; what percentage; where reports go; subdomain handling; alignment mode. It's the diagnostic that turns "why doesn't DMARC work" into a concrete list of tag-level fixes.

How it works

DMARC is one DNS record at a specific name:

  1. 1Query `_dmarc.<domain>` — DMARC lives at the _dmarc subdomain as a TXT record. So for example.com, query TXT _dmarc.example.com. The record starts with v=DMARC1.
  2. 2Parse tags — Tags are semicolon-separated key=value pairs. Required: v=DMARC1, p=<policy>. Common: rua=mailto:[email protected] (aggregate reports), pct=100 (percentage of mail to apply policy to), sp=<subdomain policy>, adkim=<DKIM alignment>, aspf=<SPF alignment>, fo=<failure report options>, ri=<report interval>.
  3. 3Validate syntax + policy strength — Tags must be syntactically correct (DMARC parsing is strict — invalid syntax = receivers ignore the record). Policy strength is reported on a scale: p=none (monitor only), p=quarantine (spam folder), p=reject (bounce). pct<100 means partial enforcement.
  4. 4Report aggregate / forensic destinations — rua=mailto: is the aggregate report destination (daily XML summaries). ruf=mailto: is forensic reports (individual failure samples — less commonly enabled because of privacy). Verify these addresses exist and your team monitors them.

When you'd use it

DMARC rollout — moving toward `p=reject`

Standard path: deploy at p=none with rua= set. Monitor aggregate reports for 2-4 weeks to identify legitimate senders failing alignment. Fix them (add to SPF, get them DKIM-signing, or add an aligned domain). Move to p=quarantine for 2 weeks. Move to p=reject. Run DMARC checks at each stage to confirm published policy matches intent.

Domain spoofing defense

Phishing campaign using your domain. Check DMARC — if p=none, your domain is not actively defended. Move to p=quarantine immediately as a stopgap; work toward p=reject after aggregate report review.

Pre-launch deliverability check

Before sending mail at scale from a new domain, configure DMARC and verify with this tool. p=none at launch is fine; what matters is that the record exists and points to a real rua= mailbox for monitoring.

Subdomain policy verification

DMARC's sp= tag controls subdomain handling. Unset = subdomains inherit parent policy. Explicit sp=reject is good for domains that have parked subdomains that should never send mail (defends against subdomain spoofing).

Aggregate report receiver setup

Confirm rua= points to an address you actually monitor. Receivers send daily XML reports. Parse with a tool like dmarcian, Postmark, or opendmarc. Without active monitoring, DMARC is half-deployed.

Reading the result

Policy (`p=`)

none = monitor only, no enforcement. quarantine = receivers should treat failing mail as suspicious (usually spam folder). reject = receivers should bounce failing mail at SMTP time. Production-ready: quarantine or reject.

Subdomain policy (`sp=`)

Policy for subdomains. If unset, subdomains inherit the parent's p=. Explicit sp= overrides for subdomains only. Common pattern: p=reject; sp=reject for full coverage, or p=quarantine; sp=reject to lock down subdomains harder than the parent.

Percentage (`pct=`)

Percentage of mail to apply the policy to. Used during gradual rollout — p=quarantine; pct=25 means 25% of failing mail is quarantined, the other 75% is just monitored. Helpful for de-risking when you're not sure what will break.

Alignment mode (`adkim`, `aspf`)

r (relaxed, default) allows subdomain alignment — DKIM signed by mail.example.com aligns with From: example.com. s (strict) requires exact match. Most setups use relaxed; strict is for security-critical domains where you want to prevent any subdomain mail from inheriting parent's reputation.

Reporting (`rua=`, `ruf=`)

rua= = aggregate reports — daily XML summaries of pass/fail counts, source IPs, alignment status. Should always be set. ruf= = forensic reports — per-message failure details with headers. Less common due to privacy concerns (the full message gets sent to you).

Common pitfalls

DMARC at `p=none` forever

Audit mode. Receivers report what they would have done but don't act. Many teams set it and forget; that means spoofers can still impersonate your domain because receivers aren't enforcing. Use aggregate reports to identify legitimate senders, fix them, then move to p=quarantine and eventually p=reject.

`rua=` set to an address no one monitors

Daily XML reports arrive forever, no one reads them. Defeats the audit purpose of DMARC. Use a service (dmarcian, Postmark DMARC, native ESP DMARC views) that parses reports into something humans actually read.

Moving to `p=reject` without monitoring

If a legitimate sender wasn't covered by your SPF/DKIM, their mail will start bouncing at receivers as soon as p=reject lands. Always: monitor at p=none for weeks, fix all gaps, then move up. Skipping monitoring is how you ship the email outage that takes down customer-facing notifications.

Subdomain DMARC missing

Without sp=, subdomain policy = parent policy. But subdomains often need DIFFERENT policy — e.g. you send marketing from marketing.example.com and want it at p=quarantine while parent is at p=reject. Explicit sp= lets you control.

Run DMARC Checker on every change, not just once.

Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card.

Start free

Frequently asked questions

What's the difference between p=quarantine and p=reject?
quarantine sends failing mail to the spam folder (still delivered, just demoted). reject bounces failing mail outright at SMTP — sender gets a 5xx response, recipient never sees it. reject is stricter and the recommended end state once your sender hygiene is confirmed.
How long should I wait at p=none before moving to enforcement?
2-4 weeks of aggregate report review at minimum. Long enough to capture your full sending cycle (weekly newsletters, monthly invoices, etc.) and identify every legitimate sender. Move to p=quarantine with pct=10 first, ramp up over weeks.
What does DMARC alignment mean?
DMARC requires that SPF or DKIM not just pass, but also align with the From: header. SPF alignment: the SPF-validated domain (envelope MAIL FROM) matches the From: header domain. DKIM alignment: the DKIM signing domain (d= tag) matches From:. Without alignment, SPF/DKIM passes but DMARC fails.
Why is my legitimate mail failing DMARC even though SPF passes?
Alignment. SPF might pass for the envelope sender ([email protected]) while the From: header shows [email protected]. They don't align. Solution: get the ESP to use a custom return-path that matches your domain ([email protected]), or rely on DKIM (signed by example.com) for alignment.
Where do DMARC aggregate reports come from?
From every receiver that processed mail claiming to be from your domain. Gmail, Microsoft, Yahoo, Apple — all send daily XML to whatever rua= you specify. Volume scales with your mail volume; high-volume senders see millions of records aggregated into the reports.
Can I have DMARC without SPF or DKIM?
Technically yes, but pointless. DMARC enforces against SPF AND DKIM alignment results — if neither is set up, every message fails DMARC alignment regardless of policy. Set up at least one (ideally both) before deploying DMARC at enforcement.
What's the BIMI tag and does this tool check it?
BIMI (Brand Indicators for Message Identification) shows your logo next to authenticated mail in supporting clients (Gmail, Yahoo). Requires DMARC at p=quarantine or p=reject. BIMI lives at a separate DNS record (default._bimi.<domain>) — not part of DMARC. We don't check BIMI in this tool.
Can DMARC break legitimate forwarding?
Yes — forwarders that don't preserve DKIM signatures (mailing lists that add subject prefixes, ARC-unaware forwarders) will trigger DMARC failures. ARC (Authenticated Received Chain) is the workaround — modern mailing lists and forwarders should implement ARC to preserve the authentication chain.

Related email tools