DMARC Checker - Free DMARC Record Lookup & Validation
Anyone can put your domain in an email's From address unless your DMARC record tells receiving servers to stop them. This free DMARC checker fetches the record published in your DNS, breaks down every tag, and runs 20 automated validation tests against it. You get an instant verdict on your record status, domain policy, and subdomain policy, plus a plain-language explanation of anything that's missing, malformed, or too lenient. No signup, no domain ownership verification - run a DMARC lookup on any domain, as often as you need.
Enter your domain to run a full DMARC lookup and security review
How to Check a DMARC Record
- Enter a domain. Type the bare domain name (example.com - no https:// or www) into the field above and run the check.
- Read the status cards. Record Status tells you whether a valid DMARC record exists. Domain Policy shows the enforcement level your record declares none, quarantine, or reject. Subdomain Policy shows whether subdomains inherit that protection or carry their own rule.
- Review the tag breakdown and tests. Every tag in your record is listed with its value, and each of the 20 validation tests reports pass, warning, or fail with the reason. Switch to the JSON view if you want the raw result to file in a ticket or share with your team.
Understanding Your DMARC Check Results
The record checker sorts every domain into one of three outcomes, and the domain policy check tells you how strong the protection actually is.
- Valid record. Your record is published, starts with v=DMARC1, carries a policy tag, and passes syntax checks. Look at the policy value before calling it done: p=none means you're monitoring but not blocking anything - spoofed mail still lands in inboxes. p=quarantine routes failing mail to spam. p=reject blocks it outright and is the end goal of every DMARC rollout.
- Invalid record. A record exists but something prevents it from working a missing required tag, a duplicated tag, a reporting address without the mailto: prefix, or a syntax error. The failing test names the exact problem. Fix the record in your DNS, or rebuild it in the DMARC Record Generator and republish.
- No record. Receiving servers have no instructions for mail that fails authentication on your domain, and you receive no reports about who is sending as you. Google and Yahoo now require a DMARC record for bulk senders, so an unprotected domain also risks deliverability, not just spoofing.
What the 20 Validation Tests Cover
The checker goes beyond confirming a record exists. It validates the record's structure (syntax and tag ordering, duplicate tags, record length, empty values, tag case), its policy configuration (policy validity and strictness, subdomain policy), its alignment settings (adkim for DKIM, aspf for SPF), its rollout controls (pct percentage tag, fo failure options), and its reporting setup (aggregate report configuration, rua and ruf address formats, report format and interval). It also flags unknown or deprecated tags left over from old configurations. Each test returns an individual pass, warning, or fail so a "valid" record with a weak spot still gets called out. Run it as a DMARC tester after every DNS change: the per-test detail is what separates a full DMARC validator from a basic record lookup.
DMARC Tags Explained
Every DMARC record is made up of tags separated by semicolons. Here is what each tag means:
| Tag | Required | What it does |
|---|---|---|
| v | Yes | Protocol version. Must be DMARC1 and must appear first in the record. |
| p | Yes | Policy for the domain: none (monitor), quarantine (send to spam), or reject (block). |
| sp | No | Separate policy for subdomains. If omitted, subdomains inherit p. |
| rua | No | Mailbox for aggregate reports - daily XML summaries of who is sending as your domain. Strongly recommended. |
| ruf | No | Mailbox for forensic reports on individual authentication failures. |
| pct | No | Percentage of failing mail the policy applies to. Defaults to 100. Used for gradual rollout. |
| adkim | No | DKIM alignment mode: r (relaxed, default) or s (strict exact-domain match). |
| aspf | No | SPF alignment mode: r (relaxed, default) or s (strict). |
| fo | No | Controls when forensic reports are generated (e.g. 1 = any failure). |
What Is DMARC?
_dmarc.yourdomain.com. It ties SPF and DKIM together: when a message fails both checks, your DMARC policy tells the receiving server what to do with it, and your reporting addresses receive data about every sender using your domain. Checking the record regularly matters because DNS changes, third-party senders get added, and a policy that was correct at setup can silently drift out of alignment. Pair this checker with the SPF Checker to validate the other half of your authentication setup, and use the MX Record Lookup to confirm where your inbound mail is routed.FAQs
_dmarc TXT record in your DNS, displays the full record, and runs 20 validation tests on it. You can also check manually with dig TXT _dmarc.yourdomain.com from a terminal, but you'll get the raw string without validation or tag analysis.Start with p=none to monitor without blocking anything, and review the reports it generates for a week or two to spot legitimate senders that aren't authenticated yet.
Move to p=quarantine to send failing mail to spam, then to p=reject once you're confident every legitimate source passes. Jumping straight to reject is how teams accidentally block their own newsletters.
A DMARC record is a TXT record at the _dmarc hostname, for example:
v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com; adkim=r; aspf=rThe version and policy tags are required; everything else is optional. The fastest way to get a correct one is the DMARC Record Generator, which assembles the record from your choices and prevents the syntax mistakes this checker most often flags.