DMARC Checker

About DMARC checker

DMARC Checker retrieves the policy published at _dmarc for a domain, validates each tag and translates it into plain English, so you can see what happens to mail that fails authentication. It separates monitoring-only policies from real enforcement, which is the difference between reports and actual spoofing protection.

How to use it

1. Enter the domain, for example example.com, in the Domain box. The tool queries _dmarc in front of it.
2. Press Check DMARC to fetch the TXT record at that name.
3. Read the banner. It shows the policy as p=none, quarantine or reject, and warns when the domain is in monitoring mode only.
4. Read the What this policy actually does section, then the Tags table listing each tag with its value and meaning.
5. Finish with Diagnostics for errors and warnings such as a missing report address.

A partial quarantine rollout

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com

This domain: failing mail goes to spam, applied to 25% of failing mail; the rest is treated as p=none. Subdomains inherit the policy. Alignment is relaxed for DKIM and SPF. Aggregate reports go to dmarc@example.com.

When to use it

• Confirming a DMARC record is valid before you tighten the policy from none to quarantine.
• Checking a supplier or client domain to see whether it can be spoofed.
• Finding out why aggregate reports never arrive because the rua address is missing.
• Reviewing whether subdomains are protected or explicitly excluded by sp=none.

Questions about DMARC checker

What is wrong with staying on p=none?

It is monitoring only. Failing mail is still delivered normally, so the domain gets reports but no protection. It is the right place to start, but a domain left there indefinitely can still be spoofed.

What does pct do?

It limits how much failing mail the policy applies to, from 0 to 100. The remainder is treated as p=none. It is a rollout aid, and the tool warns you to remove it once results look clean.

Are rua and ruf the same?

No. The rua tag receives daily aggregate summaries, which most receivers send. The ruf tag asks for per-message forensic reports containing message content, which very few receivers provide, so the tool flags it as a privacy consideration.

What makes a record invalid?

Missing the p tag, a bad policy value, a pct outside 0 to 100, duplicate tags, a report address that is not a mailto URI or an alignment value other than r or s. Two records at the same name are also an error.

Does my domain get sent to a server?

Yes. Our server performs the DNS query and does the parsing. Requests are capped at around 20 per minute per visitor.

Related tools

• SPF checkerParse a domain's SPF record and count its DNS lookups against the RFC 7208 limit of 10.
• IP LookupLook up information about an IP address
• DNS LookupLook up DNS records for a domain
• WHOIS LookupLook up WHOIS information for a domain
• PingPing a domain or IP address
• SSL LookupLook up SSL certificate information for a domain