Free DMARC Record Checker

DMARC (Domain-based Message Authentication, Reporting & Conformance) protects your domain from email spoofing.

Start with p=none to monitor, move to p=quarantine, then p=reject for full protection.

Yes, completely free.

Absolutely. The DMARC Record Checker processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the DMARC Record Checker is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the DMARC Record Checker in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The DMARC Record Checker works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

SPF, DKIM, and DMARC work together but do different jobs. SPF (Sender Policy Framework) publishes which mail servers are allowed to send for your domain, so receivers can reject mail from unauthorized IPs. DKIM (DomainKeys Identified Mail) adds a cryptographic signature that proves a message was not altered in transit and genuinely came from your domain. DMARC sits on top of both: it tells receiving servers what to do when a message claiming to be from your domain fails SPF and DKIM alignment, and where to send reports. In short, SPF and DKIM are the authentication checks, and DMARC is the policy and reporting layer that enforces them. This tool checks the DMARC record specifically; paste your domain to see your published policy, and use the SPF and DKIM checkers for the other two.

Alignment controls how closely the domain in the visible "From" address must match the domain authenticated by SPF or DKIM. The adkim tag governs DKIM alignment and aspf governs SPF alignment, and each can be relaxed (r) or strict (s). Relaxed, the default, allows the organizational domain to match — so mail.example.com aligns with example.com. Strict requires an exact match of the full domain, which is more secure but breaks more easily if you send through subdomains or third-party services. Most senders leave both relaxed because strict alignment commonly causes legitimate mail to fail DMARC. When this checker parses your record it shows the adkim and aspf values and notes that absence means the relaxed default applies. Enter a domain above to see whether its alignment is set to relaxed or strict.

Publishing a DMARC record does not make mail pass — it only sets the policy for mail that fails the underlying checks. A message passes DMARC only when SPF or DKIM authenticates and that authentication aligns with the From domain. Common causes of failure are an incomplete SPF record that omits a sending service, missing or broken DKIM signing, or strict alignment that rejects subdomains. Forwarded mail and mailing lists also frequently break SPF and DKIM. The fix is to set p=none first and read the aggregate reports sent to your rua address; they reveal every source sending as your domain and whether each one passes. Once your legitimate senders authenticate cleanly, you can safely tighten the policy. Check your domain here to confirm the policy and rua address are present before you start diagnosing failures.

The rua tag lists the address that receives aggregate reports — daily XML summaries from mailbox providers showing every IP sending as your domain and whether each passed SPF, DKIM, and DMARC alignment. These reports are the core of DMARC because they give you visibility into legitimate senders and spoofing attempts before you enforce a strict policy. The ruf tag requests forensic, or failure, reports, which are sampled copies of individual messages that failed. In practice rua is essential and you should always set it, while ruf is optional and many large providers no longer send forensic data over privacy concerns. If your record has no rua, you are flying blind. This checker flags a missing rua address and shows both tags when present, so enter your domain to confirm reporting is configured.

The pct tag sets the percentage of failing mail your policy is applied to, from 1 to 100, and defaults to 100 when it is absent. It exists to let you deploy a tougher policy gradually instead of all at once. The recommended path is to start at p=none so nothing is blocked while you collect aggregate reports, then move to p=quarantine, and finally p=reject for full protection. When you advance to quarantine or reject, set pct=10 first so only a small slice of failing mail is affected; watch the reports for collateral damage to legitimate senders, then raise the percentage toward 100 as confidence grows. This tool parses your pct value and reminds you it defaults to 100 if missing. Check your domain to see the current policy and percentage before tightening it.