Free DMARC Checker
Instantly check your domain's DMARC, SPF, DKIM, and MX records. Get plain-language results and know exactly what to fix. No technical knowledge required.
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It is a DNS policy that tells receiving mail servers what to do when an email claiming to be from your domain fails SPF or DKIM checks. Without DMARC, those failed messages are delivered anyway, meaning attackers can send emails that look like they came from you, and many inboxes will accept them.
A DMARC record also enables daily aggregate reports (sent to an address you specify) so you can see exactly who is sending as your domain, which sources are passing authentication, and which are failing. This visibility is what lets you safely tighten your policy over time from p=none to p=quarantine to p=reject.
DMARC policy levels explained
p=none (Monitor only)
No action is taken on failing mail and it is still delivered. This is the recommended starting point. Set a rua= address and review the reports for a few weeks before tightening the policy.
p=quarantine (Spam folder)
Failing mail is sent to the spam or junk folder instead of the inbox. A strong middle ground once you are confident your legitimate senders all pass authentication.
p=reject (Block failing mail)
Failing mail is rejected outright and never reaches the recipient. This is the strongest protection and the recommended end state for any domain used for serious email sending.
How DMARC, SPF, and DKIM work together
SPF and DKIM are the two authentication mechanisms that DMARC builds on. SPF verifies that the sending server is authorized to send email for your domain. DKIM adds a cryptographic signature that confirms the message was not altered in transit. DMARC then checks whether the domain in the visible “From:” address matches (aligns with) the domain that passed SPF or DKIM, and enforces your chosen policy if neither alignment check passes.
For strong protection, all three records need to be configured correctly and in alignment. A passing SPF record that does not align with the From domain does not satisfy DMARC. That is why our checker evaluates all four factors (DMARC, SPF, DKIM, and MX) and shows you where the gaps are.
Why email authentication matters for deliverability
Google and Yahoo now require DMARC (at least at p=none) for senders who send more than 5,000 messages per day. Microsoft and other large mailbox providers increasingly use DMARC compliance as a trust signal. Failing these checks can result in mail being sent to spam, or rejected entirely.
Beyond compliance, a properly configured DMARC record protects your brand. It stops bad actors from sending phishing emails that look like they came from your domain, which protects your customers and your domain's reputation.
Frequently Asked Questions
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a DNS TXT record published at _dmarc.yourdomain. It tells receiving mail servers what to do when an email claiming to be from your domain fails SPF or DKIM checks: deliver it, quarantine it, or reject it. It also enables daily aggregate reports so you can see who is sending as your domain.