DMARC checker
Look up a domain's DMARC policy and validate it: each tag explained, the policy strength judged, and the gaps that let spoofed mail through flagged.
Related tools: MX lookup · SPF checker · DKIM checker · All free tools
What receivers do with mail that fails authentication
A DMARC record is a TXT record at _dmarc.example.com that tells receiving servers what to do with mail claiming to be from the domain when it fails SPF and DKIM alignment: deliver it anyway (p=none), send it to spam (p=quarantine), or refuse it (p=reject), and where to send reports about what they saw. This tool fetches the record from Cloudflare's 1.1.1.1 resolver, falls back to the organisational domain the way receivers do, parses every tag, and reports what is missing or weak.
DMARC is one record among the many a domain depends on. For the records that take the website itself down, Upcheck re-resolves every website every 6 hours and alerts your team on a change.
Three steps, no signup
- 01
Enter a domain
The domain in the From address of the mail you send. The tool looks at _dmarc.<domain> for you.
- 02
We fetch the record
From a public resolver, over DNS-over-HTTPS. If a subdomain has none, the organisational domain is checked, as receivers do.
- 03
Each tag is explained and checked
The policy, the reporting addresses, the alignment modes, and the percentage, with a verdict and the reasons behind it.
Frequently asked questions
What is a DMARC record?
Domain-based Message Authentication, Reporting and Conformance: a policy published in DNS that builds on SPF and DKIM. It tells receivers to check that the domain in the visible From address matches the domain that passed SPF or DKIM, what to do when it doesn't, and where to send reports. It is what stops someone sending mail as you@example.com from a server you've never heard of.
What do p=none, p=quarantine, and p=reject mean?
They are the three policies. none means monitor only: failing mail is delivered as usual, but you get reports. quarantine asks receivers to treat failing mail as suspicious, which usually means the spam folder. reject asks them to refuse it outright. Most domains start at none to collect reports, move to quarantine once legitimate sources all pass, and end at reject.
Why does the tool say my record is inherited from another domain?
Because you checked a subdomain and it has no _dmarc record of its own. Receivers then look at the organisational domain, example.com for mail.example.com, and apply its policy, or its sp= subdomain policy if it sets one. The tool does the same and tells you which domain answered. Publish a record on the subdomain if you want it treated differently.
What should the rua address be?
A mailbox, or a reporting service, that can receive XML aggregate reports; rua=mailto:dmarc@example.com is the simplest form. Reports are what make DMARC useful: they show which servers are sending as your domain and which fail, which is how you find the forgotten newsletter tool before you move to p=reject. If the address is on a different domain, that domain has to publish a record authorising the reports.
Does DMARC work without SPF and DKIM?
No. DMARC passes only if SPF or DKIM passes and the passing domain aligns with the From domain. With neither set up, every message fails, and a p=reject policy would reject your own mail. Check SPF with the SPF record checker; DKIM keys live at selector._domainkey.example.com and can be read with the TXT lookup if you know the selector.
Is this DMARC checker free?
Yes. No account, no limit on checks by hand; scripted use is rate limited. Upcheck's paid product monitors the DNS records your website depends on every 6 hours and alerts your team when one changes.
One check reads the policy. Monitoring watches everything else in the zone.
Add your domains to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook when a record that matters changes.