DMARC Checker
Enter a domain to fetch its DMARC record over secure DNS. Every tag is validated and explained, the policy gets a strength grade from A+ to F, and you get concrete fixes plus a suggested record for the next rollout step.
Last updated:
Enter a domain and click Check DMARC to look up and grade its DMARC policy.
Findings
Suggested record
Publish as a TXT record at host . Fine-tune it with the DMARC Record Generator.
Tags
Grey rows are defaults that apply because the tag is not set| Tag | Value | Meaning |
|---|
How to use the DMARC Checker
- Type a domain such as example.com, or paste an email address or URL: the domain is taken from it.
- Click Check DMARC. The tool queries
_dmarc.plus your domain and parses the record it finds. - Read the grade and findings: red items break DMARC, orange items weaken it, green items are fine.
- Review the tag table to see what each tag means, including defaults for tags you did not set.
- Copy the suggested record and publish it as a TXT record at the host shown, or fine-tune it with the DMARC Record Generator.
How the DMARC grade is calculated
| Grade | Typical record | What it means |
|---|---|---|
| A+ | p=reject, pct 100, rua set, subdomains not weaker | Spoofed mail is refused and you get daily reports |
| A | p=reject without rua, or with a weaker sp | Strong protection with a gap in visibility or subdomain coverage |
| B | p=quarantine with rua, or p=reject with pct below 100 | Failing mail mostly ends up in spam |
| C | p=quarantine partly applied or without rua | Partial enforcement |
| D | p=none with rua | Monitoring phase: reports only, no protection yet |
| F | No record, invalid record, multiple records, or p=none without rua | No DMARC protection |
A safe DMARC rollout plan
- Monitor: publish
v=DMARC1; p=none; rua=mailto:[email protected]and read the aggregate reports for two to four weeks. - Fix your senders: make sure every service that sends as your domain (mail server, newsletter tool, CRM, help desk, invoicing) passes SPF or DKIM with an aligned domain.
- Quarantine: switch to
p=quarantine. Optionally start withpct=25and raise it step by step. - Reject: switch to
p=rejectwith pct 100 (the default) and keep reading reports for new senders.
DMARC passes when either SPF or DKIM passes and its domain aligns with the visible From address. With relaxed alignment (the default), mail.example.com aligns with example.com; with strict alignment, only an exact match does. Check the SPF side with the SPF Record Checker and inspect real results in a message with the Email Header Analyzer.
Where DMARC records are found
Receivers look up the TXT record at _dmarc. followed by the domain in the From header. If there is none and the domain is a subdomain, they look at the organizational domain (the registered domain, such as example.co.uk for shop.example.co.uk) and apply its sp policy. This checker follows the same discovery steps defined in RFC 7489 section 6.6.3, so the record it shows is the one receivers apply.
Frequently asked questions
What does a DMARC checker do?
It looks up the TXT record published at _dmarc.yourdomain, checks that it starts with v=DMARC1, validates each tag and explains the policy receivers will apply to mail that fails SPF and DKIM alignment. This tool also grades the policy and suggests improvements.
Which DMARC policy should I use?
Start with p=none and a rua address to collect aggregate reports. When the reports show that all your legitimate senders pass SPF or DKIM with alignment, move to p=quarantine and then p=reject. p=reject gives the strongest protection against spoofing of your domain.
Why does my subdomain show the parent domain's record?
If a subdomain has no _dmarc record of its own, receivers use the record of the organizational domain (for example example.com for mail.example.com) and apply its sp tag, or its p tag when sp is missing. The checker does the same and tells you which record applies.
What does 'external report destination not authorized' mean?
When rua or ruf point to a mailbox at a different domain, that domain must publish a TXT record named yourdomain._report._dmarc.reportdomain containing v=DMARC1. Without it, receivers should not send reports there. Most DMARC reporting services publish a wildcard record for this automatically.
Is pct still used?
pct sets the percentage of failing mail the policy applies to, from 0 to 100 (default 100). It is valid under RFC 7489, but the newer DMARC specification replaces it with a t=y testing flag, so keep pct at 100 once you have finished rolling out.
How long until DMARC changes show up?
DNS changes appear once cached answers expire, which depends on the record's TTL (often 300 to 3600 seconds). This tool queries public resolvers that may still hold the old answer for that long.
Does this tool send my data anywhere?
Only DNS queries for the domain names you check are sent, directly from your browser to Cloudflare's or Google's public DNS-over-HTTPS resolver. FreeToolCabin has no server involved and stores nothing.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.