Free DMARC Checker: Tag-by-Tag Policy Parse

Check your DMARC record

Enter a domain below. The checker reads the live TXT record at _dmarc.domain over encrypted DNS and tells you whether it parses cleanly — policy strength, subdomain policy, rollout percent, reporting addresses, and alignment modes.

Record broken or missing? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

What the checker looks for

A single TXT record at _dmarc.domain (for example _dmarc.example.com) — not at the domain root, and never two records. More than one record and receivers ignore DMARC entirely.
The v=DMARC1 version tag as the first term — a record without it is not a DMARC record.
A real policy in p= — none is monitor-only (warn), quarantine sends forgeries to spam, reject refuses them outright.
A sane rollout percent — pct below 100 leaves a fraction of failing mail unfiltered. Fine during a deliberate rollout, a gap afterward.
Aggregate reporting (rua=) — without a rua address you get no reports and cannot see who sends as your domain before tightening the policy.
Alignment modes (adkim=/aspf=) — r (relaxed) is the safe default; s (strict) requires the exact domain to match.

No record found?

Build one in seconds with the Free DMARC Record Generator — start with p=none and a rua address so you receive reports, publish the TXT record at _dmarc.yourdomain, and re-run this checker after DNS propagates.

DMARC is the policy leg — it enforces nothing without SPF or DKIM passing underneath. Run the Free Email Domain Trust Checker to see where your domain stands on the full authentication set.

Verify the rest of the set

DMARC is the enforcement leg. Generate or verify the rest of the authentication set, free, in your browser:

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does the DMARC checker look up? The checker queries the live TXT record at _dmarc.domain over encrypted DNS (via DNS-over-HTTPS), finds the record starting with v=DMARC1, and reports the policy (p=), the subdomain policy (sp=), the rollout percent (pct=), the aggregate and forensic reporting addresses (rua=/ruf=), and the alignment modes (adkim=/aspf=). Multiple records at the name fail the check — receivers ignore DMARC entirely when more than one record exists.

What does p=none mean? p=none is monitor-only: receivers take no action on mail that fails SPF and DKIM. It is the right starting policy while you discover every legitimate sender from your rua reports, but it does not stop impersonation. Step up to p=quarantine, then p=reject, one step every week or two, watching the reports between steps.

Why does the checker fail multiple DMARC records? The DMARC specification (RFC 7489) says receivers must ignore DMARC entirely when more than one TXT record exists at _dmarc.domain. If you see this failure, find the extra record in your DNS editor and delete it — keep exactly one _dmarc TXT record.

No record found — what do I do? Publish one: use the free DMARC record generator to build a v=DMARC1 TXT record (start with p=none and a rua address so you get reports), publish it as a TXT record at _dmarc.yourdomain, and re-run the checker after DNS propagates (minutes to hours).

Why does DMARC need SPF and DKIM? DMARC does not authenticate mail by itself — it builds on SPF and DKIM. A message passes DMARC only when SPF or DKIM passes AND the domain aligns with the From header. Without a working SPF or DKIM record, DMARC has nothing to enforce. Run the free SPF and DKIM checkers on this site to verify both.

Is Your DMARC Policy Actually Enforcing?