Free DMARC Checker

Verifying your domain's email authentication posture with the DMARC Checker is fast, straightforward, and requires no technical installation. Follow these step-by-step instructions to test your domain:

1. Enter Your Domain Name: Type or paste your root domain name (for example, example.com or mycompany.org) into the domain input field. Do not include protocols like https://, URL paths, or the _dmarc. prefix, as the tool automatically queries the standard _dmarc TXT host record.
2. Initiate the DNS Lookup: Click the Check DMARC button. The analyzer initiates a DNS query to fetch and parse the TXT record published under _dmarc.yourdomain.com.
3. Review the DMARC Record Syntax: Inspect the decoded raw record string displayed in the console viewer (e.g., v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com;). Verify that the version tag v=DMARC1 is capitalized and positioned as the initial parameter.
4. Analyze the Policy Enforcement Level: Check your primary policy directive (p=). Confirm whether your domain is operating in test mode (none), soft enforcement (quarantine), or maximum protection (reject), and check if a custom subdomain policy (sp=) is applied.
5. Verify Reporting Destinations: Check the rua and ruf tags to ensure mailto URIs are valid and capable of receiving XML telemetry reports from global mailbox providers.
6. Remediate Detected Issues: If no record is found or errors are flagged, log into your DNS management console (e.g., Cloudflare, Route 53, GoDaddy, Namecheap) to create or edit the TXT record, publish the recommended configuration, and re-run the check once DNS propagation completes.

A DMARC Checker (Domain-based Message Authentication, Reporting, and Conformance Checker) is an essential email security and DNS diagnostic tool that inspects, parses, and validates the published DMARC record of any domain name. DMARC represents the industry standard email authentication protocol built on top of two foundational mechanisms: Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). When you send an email, receiving mail servers (such as Google Workspace, Microsoft 365, Yahoo Mail, and corporate mail gateways) query the public DNS of your sending domain—specifically querying the TXT record located at the host hostname _dmarc.yourdomain.com—to determine how to handle messages claiming to originate from your organization.

Our online DMARC Checker performs an instant DNS lookup against authoritative nameservers to verify whether a valid DMARC TXT record exists, analyzes its syntax, and decodes every standard tag according to RFC 7489. It evaluates the enforcement policy (such as p=none for monitoring, p=quarantine for routing suspicious messages to spam, or p=reject for blocking unauthorized emails outright), verifies subdomain inheritance (sp), inspects aggregate (rua) and forensic (ruf) reporting endpoints, checks alignment mode requirements (aspf and adkim), and ensures percentage application (pct) parameters are configured accurately.

By providing an immediate visual diagnostic breakdown, the tool flags critical misconfigurations, syntax errors, missing tags, or unsafe policy levels. Whether you are an IT administrator, cybersecurity engineer, email deliverability consultant, or webmaster, the DMARC Checker gives you clear visibility into your domain's defense against email spoofing, phishing scams, and unauthorized domain impersonation.

Deploying and validating a robust DMARC record is one of the most critical cybersecurity and email deliverability measures any organization must implement. Without proper email authentication, any bad actor can forge your domain in the "From" header of fraudulent emails. Validating your DMARC setup provides crucial advantages:

• Stops Phishing and Domain Spoofing: Cybercriminals frequently impersonate trusted domain names to execute spear phishing, CEO fraud, and business email compromise (BEC) attacks against your customers, suppliers, and employees. An enforced DMARC policy (p=quarantine or p=reject) instructs global mail servers to quarantine or drop unauthenticated messages before they ever reach an inbox.
• Boosts Email Deliverability and Inbox Placement: Major Internet Service Providers (ISPs) and mailbox providers use domain authentication as a primary metric for domain reputation. Domains with authenticated DMARC records establish sender trust, reducing the likelihood of legitimate marketing campaigns, transactional receipts, and customer notifications being misclassified as spam.
• Mandatory Compliance for Major Providers: As of early 2024, Google, Yahoo, and other major email providers have enforced strict sender requirements for bulk senders (sending 5,000+ messages per day) and standard domains alike. Domains without valid SPF, DKIM, and DMARC records face immediate rate limiting, spam folder relegation, or complete message delivery failure.
• Actionable Visibility Through Reporting: DMARC is unique because it introduces feedback loops via aggregate (rua) and forensic (ruf) reports. Mail receivers send daily XML telemetry detailing which mail servers are sending email on behalf of your domain, pass/fail authentication rates, and unauthorized IP addresses attempting spoofing.
• Preserves Brand Equity and Trust: When scammers send malicious messages displaying your brand name, victims lose faith in your organization's credibility. DMARC protects your brand reputation, prevents domain blacklisting, and ensures downstream security across your digital communication channels.

Implementing DMARC successfully requires a phased, data-driven approach to secure your domain without inadvertently blocking legitimate business correspondence. Adhere to these industry best practices:

• Follow the Phased Rollout Strategy (None to Reject): Never jump directly to a strict p=reject policy on day one. Begin with p=none to monitor all legitimate mail sources (CRM systems, marketing automation, help desks, third-party transactional gateways like SendGrid or Mailgun). Once you have verified that all valid senders pass SPF and DKIM alignment, transition to p=quarantine, and finally enforce p=reject.
• Ensure Strict Identifier Alignment for SPF and DKIM: DMARC requires that either SPF or DKIM passes alignment—meaning the domain in the "From" header seen by the recipient matches the domain authenticated by SPF (Return-Path / Envelope From) or DKIM (the d= signature tag). Understand whether your systems require relaxed (aspf=r) or strict (aspf=s) alignment.
• Deploy Dedicated Mailboxes for Reporting: Aggregate XML reports (rua) can generate hundreds of high-volume automated emails daily. Never send reporting data directly to an individual employee's personal inbox; instead, route them to a dedicated parsing service or a specialized mailbox (such as dmarc-reports@yourdomain.com).
• Explicitly Define Subdomain Policy (sp): Attackers frequently exploit unused subdomains (e.g., billing.yourdomain.com or support.yourdomain.com) to bypass root domain rules. Configure the sp=reject tag to ensure that all non-existent or unmanaged subdomains are immediately shielded.
• Maintain Valid External Reporting Authorization: If your rua or ruf reporting URI points to an external domain (e.g., sending reports for domainA.com to an inbox at domainB.com), ensure that domainB.com publishes the required DMARC Report Authorization TXT record at domainA.com._report._dmarc.domainB.com.
• Audit Third-Party Email Senders Regularly: Keep an inventory of all third-party vendors and SaaS applications sending outbound email on your company's behalf. Whenever onboarding new marketing, sales, or HR tools, configure dedicated DKIM keys and SPF inclusion before sending campaigns.

Many organizations inadvertently undermine their email security or break legitimate mail delivery by committing these common DMARC mistakes:

• Publishing Multiple DMARC TXT Records: RFC 7489 strictly mandates that a domain must have exactly one DMARC TXT record published at _dmarc.yourdomain.com. If receiving mail servers encounter two or more DMARC records, DMARC evaluation terminates with a permanent error, treating the domain as having no DMARC policy at all.
• Staying Indefinitely in Monitor Mode (p=none): Leaving your policy configured at p=none indefinitely provides visibility through reports but offers zero protection against spoofing. Attackers can still spoof your domain with total impunity until you escalate to p=quarantine or p=reject.
• Enforcing p=reject Too Quickly Without Auditing Senders: Implementing an aggressive reject policy before identifying all legitimate sending systems (such as Salesforce, Zendesk, invoice gateways, or Google Workspace) will cause valid business emails to be silently dropped by receiving servers.
• Syntax and Formatting Errors in DNS Tags: Common errors include missing semicolons between tag-value pairs, using lowercase version identifiers (e.g., v=dmarc1 instead of v=DMARC1), misspelling tag names (e.g., policy=reject instead of p=reject), or omitting the mandatory mailto: prefix in rua and ruf tags.
• Exceeding the 10-DNS Lookup Limit in SPF: While DMARC itself does not have a lookup limit, relying solely on SPF without DKIM alignment can fail if your SPF record exceeds the strict 10 DNS lookup limit (RFC 7208). Always implement robust DKIM signatures alongside SPF to provide dual-path DMARC resilience.
• Failing to Monitor Subdomains and Inactive Domains: Neglecting defensive DMARC records on defensive, parked, or redirect-only domains leaves them vulnerable to spoofing. Every registered domain owned by your brand should publish a defensive record: v=DMARC1; p=reject;.