Free tool
DMARC checker
Enter a domain to read its DMARC record, see which policy really applies, and get the record to publish next. No account needed. The domain is looked up in public DNS and is not stored.
DMARC checker
How to read the result
What this checker tells you
DMARC ties SPF and DKIM to the From address and tells receivers what to do when neither lines up.
The policy that applies
A subdomain with no record follows its parent, often under a different subdomain policy. The result names the record in force, not just whether one exists at that name.
Each tag
What every tag means and whether its value is valid. Report addresses on another domain are checked against that domain's authorization record.
The next step
A record to copy: a starter if you have none, and the next policy if you are still only monitoring.
DMARC needs something to rest on, so check SPF and DKIM before you tighten the policy, and test with a real message in the header analyzer.
FAQ
Questions about DMARC
What does p=none mean?
Receivers send you reports about failing mail and take no action on it, so forged mail is still delivered. It is the right place to start, because the reports show which of your senders pass. It is not protection, so plan to move on to quarantine and then reject.
Does a subdomain need its own DMARC record?
No. A subdomain with no record of its own follows its organizational domain's record, using the sp policy if there is one and p if not. A record of its own lets it move at a different pace, which is useful for a new sending subdomain.
Is DMARC required?
For anyone sending 5,000 or more messages a day to Gmail, yes, with a policy of at least p=none. Yahoo sets a similar rule. Below that it is still the only thing that ties SPF and DKIM to the address people see.
Why am I not receiving DMARC reports?
Check that rua is set and is a mailto: address. If that address is on another domain, the other domain must publish an authorization record at yourdomain._report._dmarc.theirdomain, or receivers will not send there. This checker looks that record up for you.
What makes DMARC pass?
SPF or DKIM has to pass, and the domain it passed for has to align with the From domain. Only one of the two is needed, which is why a message forwarded through a mailing list can still pass on DKIM after SPF breaks.
Free tools
Related tools
SPF checker
Look up a domain's SPF record, follow every include, and count the DNS lookups against the limit of ten that receivers enforce.
Open the toolDKIM checker
Fetch a DKIM public key by domain and selector, and check its format, length and whether it has been revoked.
Open the toolSPF and DMARC record generator
Build the SPF and DMARC records for a new sending domain or subdomain, or check the ones you already publish, and see what each setting means.
Open the tool
Next step
A sending domain with DMARC in the records from day one
Add a domain to SendRaven and its DMARC record comes with the DNS records to publish.