Free · No signup · No credit card

DMARC Checker

Inspect a domain's DMARC policy, reporting addresses, and alignment settings — and find out whether it actually stops spoofing.

We check _dmarc.<domain>, falling back to the organizational domain exactly as a receiving server would.

Try:

Why SPF and DKIM are not enough

SPF authenticates the envelope sender — a hidden address used during the SMTP conversation. DKIM authenticates a signing domain. Neither is the From: address your recipient actually reads.

That gap is the whole attack. A spoofer sends from a domain they control, passes SPF and DKIM legitimately for that domain, and simply writes your brand into the visible From: header. Everything authenticates. The recipient sees your name.

DMARC fixes this by requiring alignment: the domain that passed SPF or DKIM must match the visible From: domain. Then it tells receivers what to do when nothing aligns — deliver anyway (p=none), send to spam (p=quarantine), or refuse (p=reject).

The rollout that works

  1. Publish v=DMARC1; p=none; rua=mailto:[email protected]. Nothing is blocked; reports start arriving.
  2. Read the aggregate reports for two to four weeks. Find every legitimate system sending as your domain — invoicing, CRM, helpdesk, marketing.
  3. Fix authentication for each one: add it to SPF, or set up DKIM signing.
  4. Move to p=quarantine. Watch for a week.
  5. Move to p=reject. Your domain is now hard to spoof.

The step people skip is the second one, and it is the one that matters. Going straight to p=reject without reading reports is how companies discover that their payroll provider was never authenticated — by having its mail rejected.

Common mistakes this tool catches

  • Typo'd tags — policy=reject instead of p=reject. The record parses, the tag is ignored, and you have no policy.
  • No rua= — a policy with no reporting address means you can never safely tighten it.
  • Stuck at p=none — the most common state, and it blocks nothing.
  • A forgotten pct= — left over from a rollout, quietly exempting most of your mail.

Frequently asked questions

What does DMARC actually do?

DMARC ties SPF and DKIM to the From: address your recipient actually sees, and tells receivers what to do when neither passes. Without it, an attacker can pass SPF using their own domain while displaying yours in the From: header — which is precisely how most brand impersonation works. DMARC closes that gap.

What is the difference between p=none, p=quarantine and p=reject?

p=none is monitoring only: receivers report failures but still deliver the mail. p=quarantine sends failing mail to the spam folder. p=reject makes receivers refuse it outright. Only p=reject actually prevents spoofing. p=none is the correct place to start, but it protects nothing on its own — it exists so you can read reports before tightening.

Why do I need a rua= address?

rua= is where receivers send daily aggregate reports listing every source sending as your domain and whether it authenticated. Without it you are blind: you cannot tell whether moving to p=reject will block a legitimate system you forgot about. Publish rua= first, read the reports for a few weeks, then tighten the policy.

Do my subdomains inherit the DMARC policy?

Yes. If a subdomain has no DMARC record of its own, receivers apply the organizational domain's policy — or its sp= tag if one is set. This tool follows the same fallback, and tells you when a result was inherited rather than published directly.

What does pct= do?

pct= applies your policy to only a sample of failing mail. With p=reject and pct=20, just 20% of failing messages are rejected and the rest are delivered normally. It is a rollout aid, not a destination — a partial policy leaves the other 80% spoofable, so remove it once you are confident.

What are adkim and aspf?

They control alignment strictness. In relaxed mode (r, the default), mail from mail.example.com aligns with example.com. In strict mode (s), the domains must match exactly. Relaxed is right for most organizations; strict can break subdomain senders and third-party services.

More free tools

Email Checker

Validate syntax, MX and disposable status for any address.

MX Lookup

See which mail servers receive a domain's email.

SPF Checker

Parse SPF and count the RFC 7208 DNS lookups.

DKIM Checker

Find DKIM selectors and check key strength.

Disposable Checker

Detect throwaway and temp-mail domains.

Blacklist Checker

Check an IP or domain against DNS blocklists.

Need to verify a whole list?

This tool stops at DNS. The Mailvalid API confirms whether an individual mailbox actually exists over SMTP — in bulk, with 95%+ accuracy. Start with 100 free credits, no credit card.

Get 100 free credits Read the API docs