Free DMARC checker

What does this checker look at?

DMARC is your domain's email impersonation protection. It's a short text record in your DNS that tells inbox providers like Gmail and Outlook what to do when a message claims to be from your domain but fails authentication.

When you enter your domain, the checker looks up the TXT record at _dmarc.yourbusiness.com and reads it. Then it checks each part of the record:

• A DMARC record has to exist, and only records that start with v=DMARC1 count.
• There must be exactly one. More than one record means providers ignore all of them.
• Your policy (the p= tag) is the instruction: none (monitor only), quarantine (send to spam) or reject (block).
• Your percentage (the pct= tag) limits your policy to part of your mail if it's set below 100.
• Your reporting address (the rua= tag) is where providers send reports, so you can see who's sending email using your domain.

A typical first record looks like this:

How do I read my results?

Your result will show one of these statuses.

Protected means your record sets p=quarantine or p=reject and applies it to all of your mail. Messages that fail authentication will go to spam or be blocked. This is the goal.

Monitoring only means your record uses p=none. That's the right place to start, because it lets you collect reports without affecting delivery. But fake messages are still delivered. Once your reports show your real email passing, move to p=quarantine.

Partially enforced means you have a quarantine or reject policy, but the pct= tag limits it to a share of your mail. That's useful while rolling out. Raise it to 100, or remove the tag, when you're confident.

Needs attention means one of three things is wrong:

• There's no DMARC record, so providers have no instructions for suspicious mail using your domain.
• There's more than one DMARC record, so providers ignore them all.
• The record is missing a valid policy, so providers can't use it.

You may also see a note that there's no reporting address. Your policy still works, but you won't receive reports, which makes it hard to know when it's safe to tighten it.

If you see Couldn't check, the DNS lookup didn't complete. That's usually temporary, so try again in a few minutes.

How do I fix common problems?

DMARC is added at your DNS host, which is usually the company where you bought your domain. It's not set inside Gmail or Outlook. Most fixes take about five minutes.

• With no record, add the starting record above, replacing the email address with an inbox you check. Our fix guide for DMARC policy not enabled has steps for common DNS hosts, and there's a dedicated GoDaddy DMARC walkthrough.
• If you have more than one record, keep one, merge any reporting addresses into it, and delete the rest.
• To move past monitoring only, confirm SPF and DKIM are working first. Check SPF with the free SPF checker, and turn on DKIM in your email admin console. After two to four weeks of clean reports, change p=none to p=quarantine.
• If you're not sure how the pieces fit, read how to stop email spoofing for the full SPF, DKIM and DMARC process.

After you save a change, DNS can take a few minutes to a few hours to update. Then run this checker again to confirm.

Is this check safe to run?

Yes. The DMARC checker only performs a public DNS lookup, the same one every email provider does when it receives a message from your domain. It doesn't send email, connect to your mailbox, or change any settings.

Nothing is installed, and you don't need to sign in. Single-check tools like this one don't store the domains you look up. If you'd like a saved report covering your website and email together, run the free website security scan.