A free DMARC record checker that resolves the live record at _dmarc for any domain, parses every DMARC tag, and reports the effective policy. A DMARC record checker and validator in one, no signup.
A DMARC checker resolves the TXT record your DNS serves at _dmarc.yourdomain and reads it the way a receiving mail server would. That is not always the DMARC record you think you published — panels split long values, and plenty of records end up at the domain root by mistake.
The free DMARC record checker parses v, p, sp, pct, rua, ruf, aspf, and adkim, then reports what a receiver would actually do with failing mail. It is a DMARC record checker and validator rather than a raw TXT lookup.
Run the DMARC checker after every publish and at every policy change. DMARC fails silently: nothing tells you a record stopped parsing except spoofed mail arriving in inboxes weeks later.
The policy. What the DMARC checker reports as the effective action on failing mail: none, quarantine, or reject.
Subdomain policy. Without it subdomains inherit p; the DMARC checker reports the inherited value explicitly.
Share of failing mail the policy applies to. A DMARC checker reads pct=25 as a partial rollout, not a full one.
Aggregate report address. A DMARC checker flags a p=none record with no rua as monitoring that reports nothing.
Forensic report address. Optional, and increasingly ignored by receivers, so the DMARC checker treats it as informational.
DKIM alignment mode. Strict breaks subdomain signing, and the DMARC checker calls that out.
SPF alignment mode, relaxed or strict. The DMARC checker reports which one is in force.
Forensic reporting options. Rarely load-bearing, but the DMARC checker parses it for completeness.
What gets resolved
A DMARC checker resolves the TXT record your DNS serves at _dmarc.yourdomain and reads it the way a receiving mail server would. That is not always the record you think you published, which is the whole reason to run a DMARC checker rather than trust the panel.
The DMARC record checker queries the _dmarc subdomain specifically. A record published at the domain root instead is the single most common DMARC mistake, and a DMARC checker finds it in one query.
DNS panels also split and truncate long TXT values, so a record that looks correct in the control panel can resolve broken. Only a live DMARC record checker sees what receivers see.
v, p, sp, pct, rua, ruf, aspf, adkim, fo. A DMARC record checker and validator reports each one with its effective meaning rather than echoing the raw string back at you.
Tag order matters at the start: v must come first and p second, or receivers discard the record entirely. The free DMARC record checker flags that before anything else.
What a receiver would actually do with failing mail, including how sp changes the answer for subdomains and how pct reduces the share affected.
This is the useful output. The raw record is easy to read; the resolved behaviour is what decides whether spoofed mail gets through.
A DMARC record with p=none and no rua is a record that tells you nothing. The DMARC checker calls that out rather than reporting a valid record and moving on.
It also flags external reporting destinations, which need an authorisation record on the receiving domain before reports will actually arrive.
Findings
Five findings cover almost everything, and each has a specific fix.
Nothing published at _dmarc.yourdomain. Receivers have no policy to apply, so SPF and DKIM results are never checked for alignment with the visible From address.
Generate one at p=none with a rua address. A DMARC record checker cannot validate a record that does not exist.
A DMARC record at the domain root does nothing. It must live at _dmarc.yourdomain. This is the mistake the free DMARC record checker catches most often.
Move it, wait for propagation, and re-run the DMARC checker.
Technically valid, operationally useless. Monitor mode with nowhere to send the aggregate reports means you learn nothing and can never safely tighten.
Add rua and wait for a couple of weeks of data before touching p.
A DMARC record checker will report this as valid, because it is. It is also doing nothing: p=none instructs receivers to take no action.
Read the reports, fix the failing legitimate senders, then move to quarantine and reject.
A stray semicolon, a tag before p, an unknown tag name. Receivers discard records they cannot parse, so the domain is effectively unprotected.
Fix the token the DMARC record checker and validator names and re-query after propagation.
When to run it
DMARC fails silently. Nothing announces that a record stopped parsing except spoofed mail landing in inboxes, so a DMARC checker in the routine beats a DMARC checker in an emergency.
Propagation plus DNS panel mangling means the string you saved and the string served are not reliably identical. Run our free DMARC record checker as soon as propagation finishes.
This one habit catches most DMARC problems before they matter.
Moving none to quarantine, quarantine to reject, or raising pct. Each change is a live edit to how receivers treat your mail.
Confirm with a DMARC checker that the intended policy is the one actually serving.
A new platform that is not SPF or DKIM aligned will start failing DMARC immediately, and under an enforcing policy that means lost mail.
Check alignment for the new source before it starts sending, not after.
If someone forwards you a phish claiming to be from your domain, the DMARC record checker is the first thing to run.
Then verify your own recipient lists too — for that, use Email Verifier, because authentication and list hygiene are two halves of the same sending workflow.
Limits
DMARC coordinates two other records and reports on nothing else.
A DMARC record checker resolves one record. Whether your SPF record is under the ten-lookup limit, or your DKIM key is published correctly, are separate checks.
A perfect DMARC policy on top of a broken SPF record enforces failure, not protection.
The DMARC checker tells you the rua address is set. It does not fetch or parse the XML that arrives there.
Reading those reports is the actual work of a DMARC rollout, and it needs a report processor.
DMARC protects your exact domain. A domain registered one character away is untouched by any policy you publish.
That threat needs monitoring, not a DNS record.
Sender authentication and recipient verification are different problems. A clean DMARC checker result does not mean the addresses you send to exist.
Run both before a campaign.
Reference
DMARC is defined by the IETF, and the tools beside this DMARC checker cover what a DMARC checker does not.
The IETF's RFC 7489 defines DMARC, its tags, alignment, and the reporting format this DMARC record checker validates against.
Every finding this free DMARC record checker reports maps back to a rule in that document.
If the DMARC checker finds nothing, the DMARC Record Generator builds a valid record with policy, alignment, and reporting tags.
Generate there, verify with the DMARC record checker here. Neither tool catches DNS-panel mangling alone.
DMARC reads SPF and DKIM results. The SPF Checker covers the record a DMARC policy depends on most.
A clean DMARC record checker result on top of a broken SPF record enforces failure rather than protection.
Nineteen free tools alongside the paid AI features, none of them requiring an account.
Free Tools
Free DMARC record generator: build a valid v=DMARC1 TXT record with policy, alignment, and reporting tags in seconds. Free DMARC policy record generator, no signup.
Domain or infrastructure evidence — not mailbox proof.
Free Tools
Free SPF record checker: resolve the live SPF record for any domain, count DNS lookups, and validate the syntax. SPF record checker and validator, no signup.
Free Tools
Free DKIM record checker: resolve the live DKIM record at any selector, validate the public key, and flag truncation or testing mode. A DKIM record checker and validator.
Free Tools
Free DNS record lookup for any domain: A, AAAA, MX, TXT, NS, CNAME, SOA resolved live from authoritative nameservers. DNS record lookup tool, free, no signup.
Email Tools
Free email header analyzer: paste raw headers and get SPF, DKIM, DMARC verdicts, the full delivery path, and every key header. Parse email headers online free.
Sender or message diagnostics — not address discovery.
Email Tools
Free email deliverability test: send one message and get authentication, DNS, spam-filter, blacklist, header, and content scores. A free email inbox placement test, no signup.
Yes — a free DMARC record checker with no signup and no account. Run the DMARC checker on as many domains as you need. It resolves live DNS on every request rather than serving a cached DMARC verdict.
The resolved record, every parsed tag with its effective meaning, the policy a receiver would apply, how sp changes it for subdomains, whether rua is set, and any malformed or misordered tags. That is what makes it a DMARC record checker and validator rather than a lookup.
It is almost certainly at the wrong host. A DMARC record lives at _dmarc.yourdomain, not at the domain root. That is the mistake this free DMARC record checker catches most often. Move it, wait for propagation, and re-run the DMARC checker.
Only as a starting point. A DMARC record checker will call p=none valid because it is, but none instructs receivers to take no action at all. Read the aggregate reports, fix failing legitimate senders, then move to quarantine and reject.
No. The DMARC record checker confirms the rua address is set and syntactically valid. Fetching and parsing the daily XML that arrives there is a separate job, and it is the actual work of a DMARC rollout.
Usually a DNS panel splitting or truncating the TXT value on save, or a stray semicolon. The DMARC checker reports what your nameservers actually serve, which is the only string receivers ever see. Re-publish and check again after propagation.
A free DMARC record checker, no signup. Resolve the live DMARC record, parse every tag, see the effective policy.
Free DMARC record checker · DMARC checker, live DNS · Every DMARC tag parsed · DMARC checker, no account
