DMARC Checker

About this DMARC Checker

Enter a domain you want to check DMARC for and quickly see if a domain publishes a valid DMARC record, what policy it enforces (reject, quarantine, or none), alignment modes, and reporting addresses. We also reveal common issues like multiple records or missing rua. This is a free DMARC checker and validator built for clarity and speed, it provides you with clear results and helps you to fix potential issues quickly.

How to use

1. Enter your organizational or sending domain (e.g., example.com).
2. Click Check DMARC. We look up _dmarc.<yourdomain> and parse your DMARC TXT record.
3. Review policy, alignment, reports, and notes.

What the results mean

• DMARC Published — Shows whether the domain has a DMARC record in DNS.
• DMARC Hostname — The exact DNS name we queried (usually _dmarc.example.com). DMARC must live at this hostname to work.
• DMARC Value — The raw TXT record.
• Policy (p) — Tells mail servers what to do with messages that fail DMARC:
  • none – monitor,
  • quarantine – spam,
  • reject – block.
• Subdomain policy (sp) — Sets a separate policy for subdomains; if missing, subdomains inherit p Used when subdomains send email.
• Alignment (adkim/aspf) — Controls how closely DKIM/SPF must match your From domain.
  • r (relaxed) allows subdomains,
  • s (strict) requires an exact match.
• Aggregate reports (rua) — Where daily XML summaries are sent about authentication results. These help you discover all sources sending on your behalf.
• Forensic reports (ruf) — Where detailed samples of failing messages are sent. Many providers limit these, so enable only if you truly need them.
• Percentage (pct) — The share of mail your policy applies to.
• Failure reporting options (fo) — When to trigger failure details:
  • 0 – only if both DKIM and SPF fail (default),
  • 1 – if either DKIM or SPF fails,
  • d – if DKIM fails,
  • s – if SPF fails.
• Report interval (ri) — How often aggregate reports are requested, in seconds. The default is 86400 (about 1 day).
• Notes — Additional useful information, potential issues and reccomendations about your DMARC.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM to tell receivers how to handle mail that fails authentication and where to send reports to monitor domain abuse.

Why DMARC matters now

Major mailbox providers (Gmail, Yahoo, Microsoft) require or enforce DMARC for bulk senders, making correct configuration essential for deliverability and phishing resistance.

Tips for better deliverability

• Publish SPF, DKIM, and DMARC for your sending domain.
• Set DMARC to p=reject once your SPF/DKIM are aligned and stable.
• Use rua to monitor and iterate before enforcing with pct and p.
• Keep alignment strict where possible for tighter protection.

Why use this DMARC checker?

• Clear and human-readable results, not just raw DNS data.
• Instant, online, no sign-up, free DMARC checker tool – perfect for quick checks and audits.
• Actionable notes that helps identify potential issues and offers useful reccomendations.

FAQ

• Is this a free DMARC checker?
  Yes. This DMARC checker is free, online, and requires no sign-up.
• How do I use the DMARC checker tool?
  Enter your domain, click the “Check” button and we’ll read _dmarc.<yourdomain> and present the results in a clear table below.
• What is DMARC in simple terms?
  DMARC tells receiving mail servers how to handle messages that fail SPF/DKIM and sends you reports so you can see who’s using your domain.
• Does DMARC replace SPF or DKIM?
  No. SPF and DKIM authenticate mail; DMARC sits on top to enforce policy and request reports.
• Do I need forensic reports (ruf)?
  Not necessarily. You can rely on rua for visibility and consider ruf only when you truly need message samples.
• What’s a usual safe rollout?
  Start p=none with ruaenabled, review for a few days/weeks, then move to p=quarantine, then p=reject once legitimate sources are aligned.
• How long do DNS changes take to show in the checker?
  Most updates appear within minutes to a few hours, depending on TTL and DNS propagation.