DMARC Record Checker

About DMARC Lookup

A domain's DMARC policy, and what it actually asks receivers to do — which is frequently less than the person who published it believes.

DMARC is the record that ties SPF and DKIM to the address a reader sees. Neither of the other two looks at it: SPF is checked against the bounce address and DKIM against whoever signed, so an attacker can pass both with their own domain while putting yours in the From line. DMARC requires that a passing check be *aligned* with the visible domain, and states what should happen when none is.

The policy is one of three words and they are not close together in effect. p=none asks receivers to do nothing at all — it is the right place to start, because it collects reports without risking delivery, and a domain left there is publishing a policy that protects nobody. p=quarantine sends failing mail to spam. p=reject refuses it, and is the only one that actually stops somebody using your domain.

Two tags undo the policy quietly. pct applies it to only part of the failing mail and lets the rest through, and a missing rua means nobody receives the aggregate reports — which are the only way to learn who sends as you before tightening anything.

A subdomain with no policy of its own inherits from the organisational domain above it, and this follows that walk the way receivers do. A checker that does not will tell somebody to publish a record they already have.

Where it helps

• Says what the policy does rather than repeating its tags back at you.
• Follows the walk up to the organisational domain, so an inherited policy is found rather than reported as missing.
• Calls out pct and a missing rua, which are the two ways a strict-looking policy does nothing.
• Reads the alignment mode, which decides whether a subdomain's signature counts.

Limits

• It reads the record; it cannot tell you how much of your mail is currently failing. That is what the aggregate reports are for.
• The organisational domain is approximated as the last two labels, which is right for .com and wrong for .co.uk.
• A record that parses is not a record that works — the addresses in rua have to accept reports from other domains, which needs its own DNS record on the receiving side if it is a different domain.
• Nothing here checks SPF or DKIM, which is the rest of the picture.

Frequently asked questions

Can I go straight to p=reject?

You can, and it is how organisations discover that their invoicing system, their CRM and a decade-old script all send as them. Start at none with a rua address, read the reports until nothing legitimate is failing, then move. The reports cost nothing and the alternative is finding out by having mail rejected.

What is pct for?

Rolling out gradually — apply reject to 10% of failing mail, see what breaks, raise it. It is a transition tool. Left in place it means most failing mail is delivered anyway, which is an open door that reads as a closed one.

Do I need a record on every subdomain?

No. A subdomain with no policy inherits the organisational domain's, or its sp if one is set. Publishing per-subdomain records is only needed when one of them genuinely needs to differ.

Related tools

• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature