DMARC checker: read a record the way a receiver does.
A DMARC record is a TXT record at _dmarc.yourdomain.com. Its p= tag tells receivers what to do with mail that fails authentication: none only reports, quarantine sends it to spam, and reject blocks it. This reads the record the way a receiver does, explains every tag, and says whether the policy is protecting anything or only watching.
A record is not the same as protection.
Most domains that fail a spoofing test have a DMARC record. It says p=none, which instructs receivers to do nothing at all — deliver the forgery, and send a report about it. That is the correct place to start and the wrong place to stay, and a checker that shows you a tidy green table without saying so is not helping.
The second thing worth checking is whether rua= is present. A policy with no reporting address is a decision made with the lights off: you will never see which of your own senders it affects.
Frequently asked questions.
It queries public DNS directly from your browser over DNS-over-HTTPS and reads the TXT record published at _dmarc.yourdomain.com. Nothing about the domain you look up is sent to a DDMARC server.
p=none instructs receiving servers to take no action on messages that fail DMARC and to deliver them as usual, while still sending aggregate reports if an rua= address is set. It is a monitoring-only policy, not a protective one.
A blank result means no TXT record exists at _dmarc.yourdomain.com, not that the domain is unprotected in some other way. Publish a record, starting at p=none, to begin collecting the reports needed before moving to enforcement.
Only at p=quarantine or p=reject, and only once every legitimate sender is authenticated with SPF or DKIM and aligned with the From: domain. A record at p=none provides visibility, not protection.
For the full walkthrough, see the DMARC setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
The record is public. Who is using it is not.
A lookup shows what you published. Only aggregate reports show who is sending as you — and those take a day or two to start arriving once the record asks for them. Monitor collects and reads them for 2 domains at no charge.