DMARC Checker
Free DMARC Checker
Look up any domain's DMARC record in seconds, see what every tag means, and generate a stronger record.
Instant DMARC Lookup
Enter a domain or email address to read its DMARC record, tag by tag.
DMARC Record Generator
Build a record to publish in DNS. Start with p=none, then tighten.
Publish as a TXT record on _dmarc.yourdomain.com:
v=DMARC1; p=noneRolling out DMARC: none → quarantine → reject
- Monitor. Publish
v=DMARC1; p=none; rua=mailto:you@yourdomain.comand collect aggregate reports for 2–4 weeks. - Fix senders. Make every legitimate service (newsletter, CRM, helpdesk) pass SPF or DKIM aligned with your domain.
- Quarantine. Switch to
p=quarantine, rampingpctfrom 25 to 100. - Reject. When reports show no legitimate failures, set
p=reject.
Checking more than DMARC? See the full email security checker.
Frequently Asked Questions
What is a DMARC record?
A DMARC record is a DNS TXT entry at _dmarc.yourdomain.com. It tells receiving mail servers what to do with messages that fail SPF and DKIM alignment, and where to send reports about them.
What do the DMARC tags mean?
v is the version (DMARC1), p the policy (none, quarantine, reject), sp the subdomain policy, pct the percentage of mail the policy applies to, rua and ruf the report addresses, and adkim/aspf the DKIM and SPF alignment modes (relaxed or strict).
How do I move from p=none to p=reject?
Publish p=none with a rua address and read the aggregate reports for a few weeks to find every legitimate sender. Fix their SPF/DKIM, then move to p=quarantine (optionally with pct=25, 50, 100), and finally p=reject once reports show no legitimate failures.
Is p=none enough?
No. p=none only monitors: spoofed mail is still delivered. It is the right first step, but enforcement (quarantine or reject) is what stops impersonation of your domain.
Want the Full Security Picture?
Email is one layer. Run a full 62-check audit covering SSL/TLS, headers, vulnerabilities, and more.
Start Full Scan