DMARC record checker

Look up a domain's DMARC record, validate every tag against the current DMARC specification, and find the problems that quietly stop reports arriving. The lookup runs from your browser against public DNS — no account, nothing stored.

Queries the _dmarc TXT record over DNS-over-HTTPS (Cloudflare, falling back to Google). Only the domain name is sent, to the resolver — never to us.

What this DMARC checker looks at

A DMARC record is a single TXT record at _dmarc.yourdomain.com. This checker fetches it, then works through it tag by tag:

  • Is there exactly one record? Two records that both start with v=DMARC1 are treated by receivers as no record at all — a surprisingly common outcome of two teams each adding one.
  • Is it published at the right name? If nothing is found at _dmarc, we check whether the record was accidentally published at the domain root instead.
  • Is every tag valid? p, sp, np, rua, ruf, adkim, aspf, fo, t and psd are each checked for a legal value, with duplicates and unrecognised tags flagged. So are pct, ri and rf, which the current specification removed but plenty of live records still carry. The tag reference covers what each one does and what its default is.
  • Will reports actually arrive? A record can be flawless and still send you nothing — see below.

The silent failure: external destination authorization

If your rua address is at a different domain from the one publishing the record — a reporting service, or your agency's mailbox — that domain has to opt in. It does so by publishing its own TXT record at yourdomain.com._report._dmarc.theirdomain.com. Without it, conforming receivers simply will not send your reports there (RFC 9990 §4).

Nothing bounces and nothing warns you. The record looks perfect and the reports never come. This checker performs that second lookup for every external rua and ruf address it finds.

What a healthy record looks like

Publishing your first one? Start in monitoring mode:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

And once the reports show your legitimate senders all aligning:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=s

The route between those two records is the whole job, and it is driven entirely by what the aggregate reports tell you — see from monitoring to enforcement.

Checking the record is the easy part

A checker tells you the record is well-formed. It cannot tell you whether the 4% of mail failing DMARC last Tuesday was a spoofer or your own invoicing system — that answer only lives in the daily aggregate reports, one from every provider, as XML. Reading those by hand across a handful of domains stops being feasible almost immediately.

That is what DMARC Analyzer does: it collects the reports from a mailbox, parses them, and shows you the sending sources per domain over time. It is free and open source, and it is self-hosted, so the reports stay on your own infrastructure. If you just want to read one report right now, the report analyzer does that in your browser.