DMARC Record Checker

Check a domain's DMARC record online: fetches _dmarc TXT, explains every tag (p, sp, pct, rua, ruf, adkim, aspf, fo, ri), and flags p=none, missing rua, pct below 100, unauthorized external report addresses and duplicate records. Free, no signup.



How to use it
  1. Enter a domain (or an email address) and click Check DMARC. The TXT record at _dmarc.<domain> is fetched.
  2. No record on a subdomain? Receivers fall back to the organizational domain, so the checker looks there too and tells you the record is inherited (the sp= tag then applies).
  3. Every tag is explained in plain English, with defaults shown for tags you left out.
  4. For each rua/ruf address on another domain, the checker looks for the <your-domain>._report._dmarc.<their-domain> record that authorizes it (RFC 7489 section 7.1). Without it, receivers may drop your reports.


Audit hundreds of domains at once
Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).
FAQ
Where does the DMARC record go?
A single TXT record at _dmarc.yourdomain.com that starts with v=DMARC1. Subdomains without their own record inherit the organizational domain's policy (sp= if set, otherwise p=).
How long should I stay at p=none?
Only long enough to read a few weeks of rua aggregate reports and fix any legitimate sender that fails SPF or DKIM alignment. Then move to p=quarantine (optionally with pct) and on to p=reject. Google and Yahoo bulk-sender rules require a DMARC record, and p=none does not stop spoofing.
Why do I need an authorization record for external rua addresses?
To stop people sending reports to a mailbox they do not own, RFC 7489 requires the receiving domain to publish yourdomain._report._dmarc.theirdomain TXT "v=DMARC1". DMARC report services usually publish a wildcard for you; if it is missing, reports may be dropped.
What do adkim and aspf do?
They set alignment mode. Relaxed (r, default) lets a subdomain match the From domain; strict (s) needs an exact match. Most domains should keep relaxed.
Is ruf (forensic reporting) worth enabling?
Usually not. Most large mailbox providers never send failure reports, and the ones that do may include message content. Aggregate rua reports are what you need.
Want the full kit?
Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.