DMARC Record Checker
Verify domain DMARC DNS TXT records. Analyzes spoofing protection policy (none, quarantine, reject), aggregate RUA reporting, and SPF/DKIM alignment rules.
Quick answer
Check _dmarc.<domain> for policy (none/quarantine/reject), RUA reporting, and SPF/DKIM alignment modes. Grade reflects enforcement strength — start at p=none, then tighten after reports look clean.
Queries DNS TXT record for _dmarc.<domain>
About this tool
DMARC tells receivers what to do when SPF/DKIM fail alignment. This tool reads the DNS TXT at _dmarc.domain and summarizes policy and reporting fields.
How to use
- Enter the apex domain (your From: domain).
- Review p=, rua=, aspf, and adkim. Note whether policy is monitoring-only.
- Fix SPF/DKIM failures first, then move p=none → quarantine → reject.
Common use cases
- Baseline DMARC before enabling reject for brand protection.
- Confirm RUA mailboxes are set so aggregate reports arrive.
- Security reviews of email authentication posture.
Example inputs
validatethis.orggoogle.comgithub.comCommon issues and fixes
No DMARC record
_dmarc.domain has no TXT record. Add DMARC to reduce spoofing and improve email deliverability.
Policy p=none only
p=none is monitoring only. Move to p=quarantine or p=reject for active enforcement.
Missing RUA reports
Without rua=mailto:..., you will not receive DMARC diagnostic aggregate reports from mailbox providers.
Recommended remediation
Add TXT at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:[email protected]; aspf=r; adkim=r — then tighten p= after reviewing reports. Validate lead emails separately at /tools/email-validator.
Pro tips
- Publish SPF and DKIM before enforcing p=reject.
- Monitor rua= reports for a few weeks at p=none.
- Subdomain policy (sp=) can differ from organizational domain policy.
FAQ
What does p=none vs p=reject mean?
p=none monitors without affecting delivery. p=quarantine asks receivers to junk failing mail. p=reject asks them to refuse it. Move gradually after SPF/DKIM pass.
Do I need SPF and DKIM for DMARC to work?
DMARC evaluates alignment of SPF and/or DKIM results. Without working SPF or DKIM, enforcement will block legitimate mail.
Is DMARC an email address validator?
No. DMARC is domain authentication policy. For 'is this email valid' format/MX/disposable checks, use /tools/email-validator.
Related security tools
DNS Lookup
Query DNS records (A, AAAA, MX, TXT, NS, CNAME) for any domain using public DNS API.
SPF Record Checker
Fetch and parse SPF (Sender Policy Framework) records for a domain to validate email security.
DKIM Record Checker
Verify DKIM DNS records. Domain + selector → TXT lookup and parse.
MX Record Lookup
Check mail server (MX) records. Priority order.
Email Validator
Validate email format and check MX records. Verify if domain accepts mail.
Run a full security check
After this tool passes, run related header and policy checks to catch transport and browser-level risks.