Free DMARC check: see if a domain is really protected

How to check a DMARC record

Enter the domain in the box above and select Validate. The check looks up the TXT record published at _dmarc.yourdomain.com and reports whether DMARC is enforced on that domain. To read the record text itself, query the same hostname with dig TXT _dmarc.yourdomain.com or any DNS lookup tool.

You do not need access to the domain. DMARC records are public DNS entries, so you can check a supplier, a customer or a domain that is sending mail in your name.

What your result means

The check returns one of three states, and the difference between them is the difference between monitoring and protection.

• Enforced. The domain publishes a record with a policy of quarantine or reject, so receiving servers act on mail that fails authentication.
• Not enforced. Either there is no record, or the record sets p=none, which asks receivers to do nothing. The domain is being watched, not defended.
• No record. Nothing tells receiving servers what to do with mail claiming to come from that domain, so forged mail passes as normal.

Most domains that fail an audit are not missing DMARC. They are sitting on p=none and have been for years.

What each tag in a DMARC record means

A DMARC record is a single line of text in DNS. Each tag does one job, and only two of them are required.

• v: the protocol version. Always DMARC1, and it has to come first. Required.
• p: the policy for the domain itself. none, quarantine or reject. Required.
• sp: the policy for subdomains. Leave it out and subdomains inherit p.
• rua: where aggregate reports are sent. Without it you get no data back.
• ruf: where forensic reports are sent. Many providers no longer send these.
• pct: the percentage of failing mail the policy applies to. Defaults to 100.
• aspf: SPF alignment. r is relaxed, s is strict.
• adkim: DKIM alignment. r is relaxed, s is strict.
• fo: which failures trigger a forensic report.

A record reading v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com is doing real work. A record reading v=DMARC1; p=none with no rua is doing none.

none, quarantine and reject, and what actually changes

The p tag is the only part of the record that changes what a receiving server does with forged mail.

• p=none: deliver as normal and send reports. Nothing is blocked. This is a listening mode, not a policy.
• p=quarantine: deliver failing mail to the spam folder. Recipients can still find it.
• p=reject: refuse failing mail at the server. It never reaches the recipient.

Moving from none to quarantine is the step that stops someone sending as your domain. It is also the step most teams never take, because they never read the reports that would tell them it is safe.

How to fix a record that is not protecting you

Going straight to reject will block your own mail if your senders are not aligned first. Work in this order.

• Publish SPF and DKIM for every service that sends mail for you, including billing, support and marketing tools.
• Publish DMARC at p=none with a rua address, so reports start arriving.
• Read the reports for two to four weeks and fix any legitimate sender that fails alignment.
• Move to p=quarantine, then to p=reject once the failures are only forged mail.
• Set sp explicitly. Attackers target subdomains precisely because sp is so often left unset.

Checking DMARC in your own code

Abstract's Email Reputation returns is_dmarc_enforced on any address you check, alongside deliverability, disposable-domain and role-account signals. It is a boolean rather than the record text, so use it to flag unprotected domains across a list at scale, and use the tool above or a DNS query when you need to audit one record in detail. The free tier covers 100 requests when you create an account.

DMARC only passes when SPF or DKIM aligns with the From domain, so run an SPF check on the same domain before you tighten the policy. To score the sending domain itself rather than its policy, the email reputation API returns domain and mailbox checks in a single request.