DMARC Checker
Audit DMARC policy and reporting tags.
Use the DMARC Checker tool
What this dmarc checker does
A DMARC record tells receivers what to do when a message fails both SPF and DKIM alignment: monitor it, quarantine it or reject it. It also supplies addresses for aggregate and forensic reports, which is how you learn who is sending mail as your domain.
This checker queries TXT at `_dmarc.<domain>` and breaks the record into its tags. It flags the risky cases: no record at all, `p=none` left in place indefinitely, missing reporting addresses and ambiguous alignment settings.
Why use it
- Confirm that a DMARC policy is published.
- Check where reports are being sent.
- Review subdomain policy before tightening enforcement.
How to use it
- 1Enter the organisational domain.
- 2Run the check.
- 3Read the policy, reporting and alignment findings, then compare them with your sending setup.
Worked examples
Enforced policy
Input
v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100
Output
Reject policy, reports enabled, full coverage.
Monitoring only
Input
v=DMARC1; p=none
Output
Warning: reports nothing and blocks nothing by default.
Common mistakes
- Moving to p=reject before reading aggregate reports, which can block legitimate mail.
- Publishing the record at the wrong name instead of _dmarc.<domain>.
- Forgetting subdomains, which may inherit a weaker or absent policy.
Frequently asked questions
What does p=none do?
It applies no enforcement. It is a monitoring mode; pair it with rua= to collect reports before tightening.
Do I need SPF and DKIM as well?
DMARC passes when either SPF or DKIM passes with alignment. Most senders publish all three.
Where do reports go?
To the addresses in rua=. They are XML attachments, usually consumed by a DMARC reporting service rather than read by hand.