Check a DMARC record and read its policy, alignment and report addresses in plain words
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 18 Oct 2026.A DMARC checker reads the TXT record at _dmarc followed by a domain, and says what receivers do with mail that fails SPF and DKIM. The 3 policies are none, quarantine and reject; only the last 2 stop forged mail. Report addresses on another domain need a permission record there.
Type the domain in the Domain field and press Check DMARC.
Read the heading: it states the policy that applies to failing mail for that domain.
Read What this record says for the policy, alignment and report addresses in plain words.
Check the findings for report addresses at another domain that have not agreed to receive reports.
Press Copy beside the record to copy it.
Type a domain and the page asks a public DNS-over-HTTPS resolver for the TXT record at _dmarc. followed by that name. The record is read tag by tag and then explained in sentences: what happens to failing mail, what happens for subdomains, how strictly SPF and DKIM must match the From address, and where the reports go.
The rules come from RFC 9989, published in May 2026, which replaced RFC 7489 as the DMARC standard. Two changes matter when reading older records. The pct tag has been removed: older receivers still use it to act on only part of the failing mail, newer ones ignore it. A t=y tag now means test mode, where receivers apply one step less than the policy. Both are flagged in words.
When a subdomain has no record of its own, receivers look for the organisational domain's record instead. This page does that with the DNS tree walk RFC 9989 section 4.10 defines, asking _dmarc at each shorter name, at most 8, and shows every name it asked. No public suffix list is used, so nothing depends on a copy of that list being current.
Report addresses on a different domain are checked for permission. RFC 9990 section 4 asks receivers to send reports to another domain only when that domain publishes a TXT record at the policy domain followed by ._report._dmarc. and the reporting host. A missing one is the usual reason a DMARC service receives nothing.
The generator tab writes a record from choices and names the host to publish it under. It leaves out tags that equal their defaults, and does not write pct.
What it does not do: it reads the record, not your mail, so it cannot say whether your messages pass. The daily reports tell you that.
The domain you type is sent to the resolver you pick, because a lookup needs it. Nothing else leaves your device.
A policy of p=none asks receivers to deliver mail that fails DMARC as normal and only send reports. Forged mail using the domain still reaches inboxes. Owners use it for a few weeks to find every legitimate sender in the reports, then move to quarantine and finally reject.
Not necessarily. When a subdomain such as mail.example.com has no record, receivers use the record of the organisational domain, example.com, applying its sp= policy if it has one and p= otherwise. A subdomain can publish its own record to override that.
Three usual causes: the record has no rua= address; the address is on another domain that has not published the permission record at yourdomain._report._dmarc.theirdomain; or the record itself is invalid, for example two DMARC records at one name, which receivers discard. This checker tests all three.
RFC 9989, which replaced RFC 7489 in May 2026, removed the pct tag. Receivers following the new standard ignore it and apply the policy to all failing mail; older receivers still honour it. The new t=y tag is the replacement for testing a stricter policy gently.
Quarantine asks the receiver to treat failing mail as suspicious, which in practice means the spam or junk folder. Reject asks the receiver to refuse the message during delivery, so it never reaches the recipient at all. Both count as enforcement; reject is the stronger protection against forged mail.
Only to the public DNS resolver you choose, Cloudflare or Google, because looking up a DNS record needs the name. The resolver sees the names asked and your IP address. Nothing else leaves your device, and the generator tab sends nothing at all.
Still stuck? Ask about DMARC Checker and anybody who knows can answer. No account needed.
Same job, other tools: SPF Record Generator – Write an SPF record for your mail providers and see how many lookups it uses · JSON Validator – Check JSON and see exactly where it breaks.
On the related tools: Find the Sender IP of an Email – Paste the headers of an email to find the IP address of the server that sent it.
Also works as: DMARC Lookup.