DMARC Record Checker
See whether a domain's DMARC policy actually protects it from spoofing.
Free, no signup — the answer appears right here.Try:
What DMARC does
DMARC is the policy layer on top of SPF and DKIM. It tells receiving servers: when a message claims to be from my domain but fails authentication, here's what to do — nothing (p=none), spam-folder it (p=quarantine), or reject it (p=reject). It also requires alignment: the domain that passed SPF or DKIM must match the From: address users actually see, which is what finally closes the spoofing hole.
DMARC also gets you visibility. The rua tag requests aggregate reports from receivers, showing every source sending as your domain — including the spoofers and the forgotten SaaS tools.
What this checker looks for
The report reads the record at _dmarc.yourdomain.com and explains it: the policy and whether it actually enforces anything, the subdomain policy, alignment modes, the percentage rollout (pct), and whether reporting addresses are set. The most common finding by far is a policy parked at p=none for years — monitoring mode with the protection switched off.
It's checked alongside SPF and DKIM because DMARC passes only if at least one of them passes with alignment — a perfect DMARC record over broken SPF and DKIM protects nothing.
Methodology & data sources
The checker reads the TXT record at _dmarc.<domain> with a live DNS query and parses it per RFC 7489: policy and subdomain policy, alignment modes for SPF and DKIM, the pct rollout percentage, and rua/ruf reporting addresses. SPF and DKIM run in the same pass, so the enforcement verdict reflects whether anything can actually align — not just whether a record exists.
Results are live, timestamped, and never served from a stale cache. Try paypal.com for a textbook p=reject policy.
Frequently asked questions
Is p=none bad?
It's the right starting point — it turns on reporting without risking legitimate mail. But it enforces nothing: spoofed mail is delivered normally. Once aggregate reports show all your real senders passing, move to p=quarantine, then p=reject.
What is DMARC alignment?
The domain that passed SPF (the envelope sender) or DKIM (the signing domain) must match the From: header domain. Relaxed alignment (default) accepts subdomains; strict requires an exact match. Without alignment, a pass on someone else's domain wouldn't protect yours.
What are rua and ruf tags?
rua= requests daily aggregate XML reports (who sent as your domain, pass/fail counts) — set it, the visibility is invaluable. ruf= requests per-failure forensic reports; many receivers don't send them and they can leak message content, so most domains skip ruf.
Do I need DMARC for a domain that sends no email?
Especially then. Parked domains are prime spoofing targets because nothing contradicts the forgery. Publish v=spf1 -all and a DMARC record with p=reject and the domain becomes useless to spoofers.