DMARC checker

Enter a domain to look up its DMARC record. We show the policy (none, quarantine or reject), where reports go, and the SPF, DKIM, MTA-STS and BIMI records that go with it.

Checks are passive and safe: we only read DNS and public pages, like a normal browser.

Need a record? Generate SPF and DMARC records for free.

How to read a DMARC record

A DMARC record is a TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100.

p: what to do with mail that fails: none (monitor only), quarantine (spam folder) or reject (refuse).
sp: the same policy for subdomains; it defaults to p.
rua: where daily aggregate reports are sent, showing every server that sends mail as your domain.
pct: the share of failing mail the policy applies to (default 100).
adkim / aspf: alignment mode, r (relaxed, default) or s (strict).

Rolling out DMARC safely

Make sure SPF is set up, and turn on DKIM signing in Google Workspace, Microsoft 365 or your sending service.
Publish p=none with a rua address and read the reports for 2–4 weeks.
Once every legitimate sender passes, move to p=quarantine, then p=reject.

Type: TXT   Host: _dmarc
v=DMARC1; p=none; rua=mailto:dmarc@example.com            # week 1-4
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com      # then
v=DMARC1; p=reject; rua=mailto:dmarc@example.com          # final

Since February 2024 Gmail and Yahoo require a DMARC record from anyone sending more than 5,000 emails a day to them; without it, your mail is more likely to be rejected or land in spam.

Common DMARC errors

No record found: the TXT record is on @ instead of _dmarc, or the DNS change hasn't propagated yet.
Two DMARC records: receivers ignore both. Keep exactly one.
Stuck on p=none: spoofed mail is still delivered; it only gives you reports.
Mail fails after p=reject: a sender (newsletter, CRM, helpdesk) isn't in SPF or isn't signing with DKIM for your domain. Check the rua reports.

Check your whole site, not just one thing

The free scan checks SSL, email spoofing, security headers, exposed sensitive files, outdated CMS and signs of hacking in one go, with plain-language fixes.

Free once you verify your domain: weekly re-scans and email alerts for new issues. PRO ($19/month): deep scan with 5,000+ known-vulnerability checks, deep re-scans up to 10 times a day and 5-minute uptime monitoring.

Run the free full scan See PRO

FAQ

What does a DMARC checker do?

It looks up the TXT record at _dmarc.yourdomain and reads its policy, reporting address and other tags, so you can see whether spoofed mail using your domain would be delivered, sent to spam or rejected.

Which DMARC policy should I use?

Start with p=none and a rua address to collect reports, then move to p=quarantine and finally p=reject once all your real senders pass SPF or DKIM.

Is DMARC required?

Gmail and Yahoo require DMARC for bulk senders since 2024, and many security questionnaires ask for it. Even small domains should publish one, because without it anyone can send email as you.

Does this check DKIM?

Partly. DKIM keys live under a selector that differs per provider; we try common selectors (Google, Microsoft 365 and others) and show any we find.