Free DMARC Record Checker — Plain-English Results
Enter a domain to run a free DMARC record check. No signup required. This checker explains your results in plain English — whether your email is protected, and what to fix next.
How to read your DMARC check
A DMARC record is one DNS TXT entry published at
_dmarc.yourdomain.com. It tells mailbox providers two
things: what to do with mail that fails authentication, and where to
send reports about it. This checker reads that record live and explains
it — no signup, no account.
The three policies, in order of strength
- p=none — monitoring only. Failing mail is still delivered. Reports flow, nothing is enforced.
- p=quarantine — failing mail is treated as suspicious, typically routed to spam.
- p=reject — failing mail is refused outright. The strongest setting, and the one to reach only once your real senders authenticate.
Common questions
What does this DMARC checker actually check?
It looks up the _dmarc TXT record for the domain you enter, over DNS, and reads it back to you in plain English: whether a record exists at all, whether its syntax is valid, what enforcement policy it sets (p=none, quarantine or reject), and whether it asks for aggregate reports to be sent anywhere. The check is read-only — nothing is ever written to your DNS.
What does p=none mean? Am I protected?
No. p=none is monitoring only: mail that fails authentication is still delivered exactly as before. It is the right place to start, because it lets reports arrive without risking legitimate mail, but a domain left on p=none indefinitely gets no protection from spoofing. Enforcement begins at p=quarantine and is strongest at p=reject.
My domain has no DMARC record — what happens now?
Nothing is blocking your mail today, but nobody is checking who sends as your domain either, and you get no reports. Since the 2024 bulk-sender rules from Google and Yahoo, sending domains without DMARC increasingly hit delivery problems. Publishing a single DNS TXT record at _dmarc.yourdomain.com starts the process.
Does having a DMARC record mean my email is safe?
Not on its own. DMARC only takes effect when a message also passes SPF or DKIM and that passing check aligns with the domain in the From header. A record with p=reject in front of misaligned senders will start rejecting your own legitimate mail. That is why the aggregate reports matter: they show which of your senders actually align before you tighten the policy.
Is this checker free, and do I need an account?
It is free and needs no account. Enter a domain, get the verdict. You can check any domain — your own or a client's.
How often should I re-check?
A one-off check is a snapshot of the record, not of your mail. It cannot tell you that a sender started failing on Tuesday, because that only shows up in the aggregate reports mailbox providers send over the following days. That is what continuous monitoring is for.
Every part of a DMARC record, explained
A DMARC record is one DNS TXT entry at _dmarc.yourdomain. This checker reads it and grades it — here is what each tag it looks at means.
v=DMARC1— the version. It must come first, and it is how a receiver recognises the record at all.p=— your policy for the domain:none(monitor only),quarantine(send failing mail to spam) orreject(block it). This is the most important tag, and the three policies are explained in order of strength above.rua=— the address that receives the daily aggregate reports. Without it you get no reports and no visibility, which is why the checker warns when it is missing.ruf=— the address for forensic (message-level) reports. Most providers no longer send these and they can carry message content, so we do not recommend adding one.pct=— the percentage of mail the policy applies to, used to roll a policy out gradually (for examplepct=25).sp=— a separate policy for subdomains. Leave it out and subdomains inheritp=; set it when you want them treated differently.adkim=andaspf=— how strictly DKIM and SPF must align with your From domain:r(relaxed, the default) ors(strict).
Common misconfigurations
- No
rua=. The record is valid but you never see who is sending as you. Add a reporting address. - Jumping straight to
p=reject. Enforce before you have watched the reports and you can block your own legitimate mail. Start atp=none. - The record on the wrong host. It must live at
_dmarc.yourdomain, not the root — a common copy-paste slip. - Two DMARC records. Only one
_dmarcTXT record is allowed; a second one makes DMARC fail. - Passing auth but failing alignment. SPF or DKIM can pass for a different domain than the one your reader sees; DMARC needs one of them to align with your From domain.
What to do for each result
Protected (a strong pass). Your record is at p=quarantine or p=reject with reporting on. Keep watching the weekly reports for new senders — nothing to change today.
Published but not enforcing (a warning). You are usually at p=none: reports are flowing but failing mail is still delivered. Work through your legitimate senders, then move up to quarantine and reject.
Not protected (a fail). There is no DMARC record, or it cannot be read. Publish one — start at p=none with a rua= address — using the DMARC record generator, then re-run this check.
All the free checkers
Read-only DNS lookups with plain-English fixes. No account needed for any of them.
The one above — policy, reporting addresses, and what to fix, in plain English.
READ-ONLY DNS LOOKUPReads your SPF record, counts DNS lookups against the limit of 10, and flags the ~all vs -all ending.
READ-ONLY DNS LOOKUPFetches a selector’s public key and confirms it resolves — the piece that silently breaks when keys rotate.
READ-ONLY DNS LOOKUPTells you whether your logo SVG and record qualify before you pay for a VMC certificate.
READ-ONLY DNS LOOKUPVerifies your inbound TLS policy and gives you the records to paste for encrypted-delivery reporting.
READ-ONLY DNS LOOKUPAnswer three questions, get a correct DMARC record to paste — starting safely at p=none.
NO ACCOUNT NEEDEDDrop a raw aggregate XML file and read it back as plain English — no signup, nothing stored.
RUNS ON PASTEA one-off check is a snapshot — DMARC needs watching
PlainDMARC monitors your domains continuously and sends a weekly plain-English verdict per domain — what passed, what failed, and what to fix.