Free DMARC check
Check a domain's DMARC record: the policy receivers apply, where reports go, and the exact record that fixes what is wrong. Free, no signup.
Reads public DNS only: nothing is changed and no email is sent.
What the check reads
One record that tells receivers what to do with failing mail.
- p=
- The policy for mail that fails: none (monitor), quarantine (spam folder) or reject.
- rua=
- Where receivers send daily aggregate reports. Without it you cannot see who sends as your domain.
- pct= and sp=
- pct= below 100 applies the policy to only part of your mail; sp=none leaves subdomains unprotected.
- adkim= and aspf=
- Relaxed (r) or strict (s) matching between your domain and the SPF and DKIM domains.
Questions, answered
Before you change the record.
What should my DMARC record say?
Start with p=none and a rua= address, so reports show every service that sends email as your domain while nothing is blocked. Once each one passes SPF or DKIM aligned with your domain, move to p=quarantine, then p=reject.
Why does the check show my parent domain's record?
A subdomain without its own record falls back to the record of the domain above it, for example mail.example.com to example.com. Receivers apply that policy, or its sp= value, to the subdomain.
How soon does a change show up?
Once your DNS provider publishes the new record and the old one's TTL runs out, usually within minutes to a few hours. Run the check again to see what receivers see now.
Does this check change anything or send email?
No. It reads the public DNS record at _dmarc.yourdomain, the same one every receiver reads.
Related tools