Check a domain’s live DMARC policy: enforcement level, report addresses and alignment
What is the DMARC Checker?
The dmarc checker works like this: it reads the live DMARC TXT record published at _dmarc.<domain> (with the organization-domain fallback real receivers use) and grades the policy: what mail servers are told to do with spoofed email, whether aggregate reports are configured, and how strictly DKIM and SPF results must align with the From domain. Everything happens on your device - the input never leaves your tab unless the tool clearly states it performs a server-side lookup.
How to use the DMARC Checker
Type the domain you want to check (e.g. example.com) and press Check.
Read the verdict banner first: pass (enforcement active), warn (monitoring only) or fail (no record).
Check the parsed tags: p= is the policy receivers apply, rua= is where reports go, sp= covers subdomains.
Follow the recommended next steps in order - they are ordered by impact.
Features
Reads the authoritative DNS record via Cloudflare with Google DNS as an automatic fallback
Organization-domain fallback: a subdomain inherits its parent DMARC record exactly like real receivers resolve it
Explains every tag (p, sp, pct, rua, ruf, adkim, aspf) in plain language
Never guesses: if the DNS lookup fails, the result says so instead of reporting "no record"
Common mistakes to avoid
Publishing p=none forever - monitoring-only DMARC does not stop a single spoofed email
Setting pct=50 with p=reject, which randomly lets half of spoofed mail through
Forgetting the rua= address, leaving you blind to both spoofing attempts and your own alignment failures
Enforcing p=reject before legitimate senders (newsletters, billing systems) are listed in SPF/DKIM
Getting a reliable answer for dmarc checker without installing an app
One-off tasks done in under a minute from any device
Checking results before committing them to something important
Working on a phone where desktop software is unavailable
Privacy
The domain name you type is sent to this site’s DNS lookup endpoint only to retrieve the public record. DNS records are public by design - the query reveals nothing that is not already published. Nothing is stored beyond a short cache.
Frequently asked questions
What is a good DMARC policy to start with?
Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. The reports show every service sending as your domain; once they all pass SPF and DKIM alignment, move to p=quarantine, then p=reject.
Does DMARC stop spam?
No. DMARC stops EMAIL SPOOFING - mail that forges your domain in the From address. Ordinary spam from other domains is handled by spam filters, not DMARC.
Why does my subdomain show my parent domain’s record?
That is how DMARC works: receivers walk up to the organization domain when a subdomain has no record of its own. The checker follows the same lookup algorithm.
What are aggregate reports (rua)?
Daily XML reports sent to the address you choose, listing every message that claimed to be your domain, whether it passed, and which servers sent it. They are free monitoring for your domain’s identity.
Related tools
SPF Checker - Validate SPF records with the real RFC 7208 include-chain walk and 10-lookup budget
DKIM Checker - Find DKIM public keys on common selectors and inspect key type, size and flags
Domain Age Checker - Look up domain age, registrar, expiry and nameservers from the official registry