DMARC Record Checker
Queries a public record from our server — not your files.
Read the DMARC record a domain publishes, tag by tag, with what each one is doing to your mail. It looks in the right place — _dmarc.yourdomain, not the domain itself — and if it finds nothing there it checks the apex too, because a record published one level up looks perfectly correct in a DNS panel and has no effect whatsoever. Checking a public record needs a resolver, so the domain you type goes to our server and comes back with what DNS says about it. Your files never enter into it.
This tool is an exception on this site. Everything else here runs entirely in your browser, but a web page cannot query DNS, read a certificate or see another site’s response headers — so the name or URL you enter is sent to our server, which looks up the public record and sends the answer back. The answer is cached for up to a minute. No file of yours is read, uploaded or stored, and there is no account.
How to use DMARC Checker
- 1
Enter your domain — the tool adds the _dmarc prefix itself.
- 2
Check the policy and whether a rua= reporting address is set.
- 3
Read the findings: they name what the current record does and does not protect.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Does this send my data anywhere?+
It sends the domain name to our server, which queries public DNS for the TXT record at _dmarc.yourdomain. A DMARC record is published for every receiving mail server in the world to read; there is nothing private in the exchange, and nothing of yours is uploaded.
It says no record, but I definitely published one.+
Then check the hostname. DMARC lives at _dmarc.example.com, and the single most common mistake is publishing it on the domain itself, where the DNS panel shows it happily and no receiver ever looks. This tool checks the apex when the correct name is empty, and tells you if that is what happened.
What should the policy be?+
p=none while you are learning, then quarantine, then reject. The reports that arrive at your rua= address during the none stage are the entire point: they list the senders you had forgotten — an old CRM, a helpdesk, a mailing platform on a subdomain. Going to reject before reading them rejects those senders instead of telling you about them.
Is a record with no rua= useful?+
Much less than it looks. Without a reporting address the policy runs blind: you can enforce it, but you never learn what it caught, so you cannot tell "no legitimate mail is failing" from "we are silently losing invoices". It is the one tag worth adding before any others.
Do I need SPF and DKIM first?+
Yes. DMARC acts on mail that fails both SPF and DKIM alignment, so with neither in place it has nothing to evaluate. Publish SPF, turn on DKIM signing with your provider, confirm both pass, and add DMARC on top of them.