Free email-authentication toolkit
Enter any domain to fetch its live DMARC record over DNS-over-HTTPS. We parse every tag and explain it in plain English — including the policy, reporting addresses and alignment settings. No signup, no backend: everything runs right here in your browser.
Enter a domain to fetch its _dmarc TXT record and get a plain-English breakdown of every tag.
Three steps
Type the domain your mail comes from — example.com, not the full URL. We query _dmarc.example.com for TXT records over DNS-over-HTTPS, which is the same record a receiving mail server reads when it decides what to do with a message claiming to be from you.
Every tag the checker reads — p, rua, sp, pct, adkim and aspf — gets its own row explaining what it does, with a warn or fix badge on anything that needs attention. The pill at the top of the card — Pass, Warning or Fail — is the worst verdict across all the rows, so one weak tag holds back the whole record.
Edit the TXT record at your DNS host, then re-run the check once the previous value's TTL has expired. A record often takes more than one pass before every row comes back clean, and it is worth re-checking each time you add a new sending service.
Scope
| Tag | What the checker reports | Verdict |
|---|---|---|
| p=reject | Full enforcement — mail that fails authentication is rejected. | Pass |
| p=quarantine | Failing mail is quarantined. A good place to be, but not the end state. | Warning |
| p=none | Policy not enabled: you are monitoring, and nothing is blocked anywhere. | Warning |
| p | Missing, or set to something other than none, quarantine or reject — the record gives receivers no instruction they can act on. | Fail |
| rua | Present: the reporting address is read back to you so you can confirm it is the one you meant to publish. | Pass |
| rua | Absent: no aggregate reports, so nothing tells you who is sending as your domain. | Warning |
| sp=none | Shown only when you publish it. A subdomain policy of none is flagged because it exempts every subdomain from p. | Warning |
| sp | Any other subdomain policy — quarantine or reject — is read back to you and passes. | Pass |
| pct | Shown only when it is present and is not exactly 100, because the policy then applies to a sample of your mail rather than all of it. | Warning |
| adkim / aspf | Shown when present, as strict or relaxed alignment. Reported for reference, not judged — both modes are legitimate. | Pass |
Two limits are worth knowing. The checker reads the first TXT record it finds that starts with v=DMARC1, so it will not tell you that you have published two DMARC records — and when there are two, receivers apply neither. It also stops at the record itself: it does not check ruf or fo, whether an external rua destination has authorised your domain with a yourdomain.com._report._dmarc.<their-domain> TXT record on their side, or whether the reporting mailbox accepts mail at all.
Subdomains
Enter mail.example.com and we look up _dmarc.mail.example.com — exactly what you typed, with no fallback to the organisational domain. Most subdomains have no record of their own, so a Fail here usually means no subdomain-specific record rather than no protection: receivers apply the parent domain's p, or its sp where one is published. Check the parent domain as well before you change anything, and see DMARC record tags explained for how sp overrides p.
Because www is nearly always a website rather than a mail sender, a leading www. is stripped before the lookup: enter www.example.com and you get the record for example.com. Every other label is kept as typed, so mail.example.com and news.example.com are checked as the distinct hosts they are. If you specifically need to see whether www carries its own policy, query _dmarc.www.example.com directly with dig.
The basics, briefly
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record published at _dmarc.yourdomain.com. It tells receiving mail servers what to do with messages that fail SPF and DKIM alignment — and where to send aggregate reports so you can monitor your sending sources. Use the checker above to read yours instantly.
The p tag is DMARC's policy. none monitors only — failing mail is delivered unchanged. quarantine routes failures to spam, and reject blocks them outright. Most domains should progress none → quarantine → reject as they gain confidence in their alignment. New to this? Read DMARC record tags explained.
The rua tag sets the email address for daily aggregate XML reports. Without it you can't see who is sending mail on your behalf — you're flying blind. Add rua=mailto:[email protected] (or use a third-party inbox) the moment you publish your first record at p=none.
Enter the full subdomain — mail.example.com — and the checker queries _dmarc.mail.example.com. There is no fallback to the parent domain, so an empty result means that subdomain publishes nothing of its own; the parent's policy still governs it. You rarely need a record per subdomain. When you do want subdomains treated differently, publish an sp tag on the organisational domain instead of scattering records across hosts.
Two different results read as invalid. No DMARC record found means nothing at _dmarc.yourdomain.com began with v=DMARC1 — most often the record was published on the domain itself instead of the _dmarc host, or the version tag is misspelt. A p= row badged fix means the record was found but its policy tag is missing or is not one of the three permitted values. Correct the tag, wait for the TTL, then check again — see DMARC record tags explained for the syntax.
No. The lookup runs entirely in your browser — there is no backend behind this page and no account to create. The domain you enter goes only to the public DNS-over-HTTPS resolvers that answer the query (Google's first, Cloudflare's if that fails), because that is where the record lives. It never reaches a DMARCmetric server, and no result is stored.
rua requests aggregate reports: an XML summary, typically one per operator per day, counting how much mail claimed to be from your domain, from which IP addresses, and whether it authenticated. ruf requests forensic reports — redacted copies of individual failing messages — which most large providers no longer send. Publish rua first: it is the tag that turns a policy into something you can act on. Full comparison in RUA vs RUF: DMARC report types.