DMARC Checker
Inspect your domain’s DMARC record, policy and reporting settings.
Understand your DMARC configuration
See what is published in DNS before making changes.
- Record validity Syntax, required tags and duplicate records.
- Policy Domain and inherited subdomain policies.
- Alignment modes Published SPF and DKIM alignment settings.
- Reporting Aggregate and failure report destinations.
A DNS lookup checks configuration. It does not verify authentication of an individual email.
How the check works
- 1Enter your domain
Provide the domain you want to check, for example example.com.
- 2Retrieve the DMARC policy
We query the _dmarc subdomain for its TXT record and parse the result.
- 3Review findings and DNS details
See the published record, detected settings and helpful guidance.
Frequently asked questions
What do none, quarantine and reject mean?
They are requested policies. none asks for monitoring, quarantine asks receivers to treat mail as suspicious, and reject asks them not to accept it. A receiver is not required to apply the request exactly, and this lookup does not guarantee delivery.
Where is my DMARC record published?
The check starts at the TXT record for _dmarc followed by the domain you enter. If that name has no applicable record, discovery can continue at parent names. The report names the DNS name that supplied the policy.
Does this check verify email authentication?
No. It reads published DNS policy. A message passes DMARC when either SPF or DKIM passes and aligns with the visible From domain. Both do not have to pass.
Can a domain inherit a policy?
Yes, when the queried name has no applicable DMARC record and a parent name publishes one. An existing subdomain uses sp when that tag is valid, otherwise p. A name that does not exist uses np when that tag is valid. The organizational domain comes from the DNS Tree Walk, not from assuming the last two labels.