DMARC checker

DMARC Checker

Look up the DMARC policy published for a domain and understand what its key settings ask receiving mail servers to do.

Free DNS lookup

Check a domain

Enter a domain, website URL, or email address. We’ll look up its published DMARC policy.

What DMARC is

Domain-based Message Authentication, Reporting, and Conformance (DMARC) publishes policy and reporting settings for email authentication.

When to use this checker

Use it to see whether a DMARC record is present, interpret its published policy, or review alignment and reporting fields.

What MailDNSLab checks

It requests TXT records at _dmarc.<domain>, identifies the DMARC record, and safely parses the supported policy, alignment, and report-destination fields.

Understand the result fields

A policy expresses what the domain owner asks receiving systems to do. Individual receivers still make their own handling decisions.

v=DMARC1: Identifies the record as DMARC version 1.
p=none | quarantine | reject: none requests monitoring without enforcement; quarantine asks receivers to treat messages that fail DMARC as suspicious; reject asks them to reject those messages.
sp=: Sets a policy for subdomains when present. If omitted, DMARC’s normal policy inheritance applies.
adkim= | aspf=: Select relaxed (r) or strict (s) domain alignment for DKIM and SPF. Relaxed alignment can allow an aligned parent domain; strict alignment requires an exact domain match.
rua= | ruf=: rua lists aggregate report destinations. ruf lists forensic or failure report destinations. Their presence does not prove the destinations are valid or actively monitored.

What this result does not prove

That the domain is secure or spoofing is impossible
That mail will be delivered or every receiver will behave identically
That SPF and DKIM work correctly end to end
That reporting destinations are valid or monitored
That the configuration meets any legal or compliance standard

Common questions

What does p=none mean?

It asks receivers to evaluate DMARC and enables reporting without requesting quarantine or rejection. It is commonly monitoring-oriented and is not automatically a bad configuration.

Is p=reject always better?

No. A stricter published policy has operational consequences. Organizations commonly review legitimate sending sources and reports before changing enforcement.

Why can the result change?

DNS records, propagation, resolver caches, and temporary DNS conditions can change what a lookup returns.

What should I do if no record or a malformed record is found?

Check the domain spelling. Then review the TXT record at _dmarc.<domain> with the domain’s DNS provider. A malformed result means a DMARC-like record exists but cannot be safely interpreted.

These tools answer different questions. Use either one when it fits your investigation; neither is a substitute for the current check.

DKIM CheckerCheck the public key for an exact selector used in DKIM authentication and DMARC alignment.SPF CheckerInspect the separate sender policy that can participate in DMARC alignment.MX LookupSee which public mail servers are listed to receive mail for the domain.