DMARC checker

Use this DMARC checker to read policy and reporting permissions, probe DKIM keys and inspect BIMI, MTA-STS and TLS-RPT. Add your actual selector for a precise key check.

Free, no account. Ten lookups per hour, shared with our other domain checks.

We send the domain to our API, which reads its public DNS records. Answers are kept for five minutes.

Copy the s= value from a received DKIM-Signature. We also probe documented common provider selectors.

A DMARC checker reads the policy for messages that fail aligned SPF and DKIM. This suite explains every tag, inheritance and external report permissions, probes documented DKIM selectors and key strength, and checks BIMI, MTA-STS and TLS-RPT. A missing common selector does not prove DKIM is absent; test the selector from a received message.

How to use this checker

Enter your domain
Use the domain in your From address, such as example.com. For a subdomain such as mail.example.com we read its own record, or the one it inherits from example.com.
Read the policy
p=none monitors mail, p=quarantine asks receivers to treat failing mail as suspicious and p=reject asks them to refuse it. Receiver decisions can differ. pct controls enforcement coverage; rua names aggregate report destinations.
Fix the mistakes
Each problem is listed with what to change. Move to quarantine or reject only after the reports show that all your real mail passes SPF or DKIM.

Questions about this checker

Google requires DMARC for senders above 5000 messages a day to personal Gmail accounts. Yahoo requires it for bulk senders without specifying that same threshold. Both accept p=none as the initial policy; use reports to check legitimate senders before enforcing.

Start with p=none and a rua address, and read the reports for a few weeks. Fix any service that fails, then move to quarantine and later to reject, which gives the most protection against mail sent in your name.

When a subdomain has no record of its own, receivers use the record of the main domain, with its sp policy when it has one. We show that record and the policy that applies to the subdomain.

When rua points to another company’s domain, that domain must publish a record that accepts reports for yours, or receivers may not send them. We check this for up to four outside addresses.

Related tools

  • SPF record checker

    Use this SPF record checker to expand includes and inspect candidate IP ranges. Add your public sending IP to trace mechanism order, macros and the DNS lookup limits.

  • BIMI checker

    Use this BIMI checker to read your BIMI record, the DMARC policy it depends on, the SVG logo and the mark certificate. Each problem comes with the fix.

  • Email header analyzer

    Use this email header analyzer to read delivery hops, delays and receiver authentication results. Inspect alignment and ARC assertions without uploading your headers.

Check your business in AI answers

Email records protect your name in the inbox. The free AI visibility scan shows how ChatGPT and other assistants describe your business.

Run the free AI visibility scan