Free DMARC Checker

The tags, and the defaults you did not set

A DMARC record is a TXT record at _dmarc.yourdomain.com. Most checkers show you the tags you wrote. The ones that matter more are usually the ones you left out, because every omitted tag still has a value:

The one that catches people is sp. It inherits from p, which is the safe behaviour, right up until someone sets sp=none "for safety" while running p=reject. That combination leaves every subdomain, including ones that do not exist, freely spoofable while the dashboard says the domain is enforced.

"We have DMARC" usually means p=none, which enforces nothing

p=none is monitoring. It asks receivers to send you reports and to take no action on failures, which means a message that fails both SPF and DKIM alignment is delivered exactly as it would be with no DMARC record at all.

This matters more than it used to. Since the 2024 bulk-sender requirements at Google and Yahoo, any domain sending at volume needs a DMARC record, and p=none satisfies that requirement. A very large number of domains published p=none, ticked the box and stopped. If your record says p=none today, you have compliance and telemetry, not protection.

The ladder out is boring and works:

pct is what makes this safe: at pct=25 the policy applies to a quarter of failing mail, so a forgotten sender shows up as a trickle of complaints rather than an outage. Note that pct was removed in the newer DMARCbis work, so treat it as a rollout tool you stop relying on rather than a permanent setting.

Why your reports never arrive

Two causes, and the second one is invisible without knowing to look for it.

The mailbox cannot handle the volume. Aggregate reports are gzipped XML sent once per day per reporting receiver. For a domain of any size that is a lot of attachments landing in a human inbox. Point rua at a parser, not at a person.

Cross-domain reporting is not authorised. If your rua address is at a different domain from the policy, RFC 7489 requires that other domain to opt in by publishing an authorisation record. Point rua at dmarc@reports.vendor.com for policy domain example.com and the vendor must publish:

example.com._report._dmarc.reports.vendor.com  TXT  "v=DMARC1"

Without it, conforming receivers silently drop the reports. Nothing errors, nothing bounces, the reports simply never come. Vendors normally create this for you when you onboard, but a hand-rolled rua pointing at your own second domain will not have it.

Alignment is the whole point

DMARC does not check whether SPF or DKIM passed. It checks whether the domain that passed matches the domain the recipient sees in the From: header. That is alignment, and it is why a message can pass SPF cleanly and still fail DMARC: the envelope sender was your bulk provider's bounce domain, not yours.

Relaxed alignment (the default) lets mail.example.com align with example.com. Strict requires an exact match. Almost everyone should stay relaxed; strict mainly breaks subdomain senders you forgot about.

If a sender fails alignment, the fix is at the sender: give it a custom return-path or a DKIM key on your own domain. Check what you have now with the SPF checker and the DKIM record checker.

One incentive for finishing the ladder: BIMI, which puts your logo next to your mail in supporting clients, requires p=quarantine or p=reject. p=none does not qualify.

From the command line

Keyless, no signup:

curl -s "https://api.domainee.dev/v1/tools/dmarc-record-checker?domain=example.com" | jq

Returns the raw record, the parsed tags and an issues array by severity. Rate limits are per IP and there is no uptime commitment, so it suits scripts and audits rather than a production dependency.

Domainee is a custom domains API for SaaS with a native MCP server, 50 domains and 100 GB free. Mail authentication and web custom domains are separate problems; this tool covers the first.