Free DMARC checker
DMARC checker: is this domain actually enforcing?
See whether a domain’s DMARC record is monitor-only or enforcing. We parse p=, t=, and rua (pct is historic), then give the next DNS record and the none → quarantine → reject path.
How to read this
DMARC (RFC 9989, May 2026, replacing RFC 7489) is a DNS policy at _dmarc.<domain>. It does not send mail and it does not replace SPF or DKIM. It tells a receiving system what to do when a message uses your domain in the visible From: header but fails to align with SPF or DKIM. Aggregate reports are RFC 9990; failure reports are RFC 9991.
The tag that matters for spoofing and for most cyber-insurance forms is p=. RFC 9989 calls p=none with rua Monitoring Mode: receivers still deliver the message while you read reports. p=quarantine asks them to treat failures as spam. p=reject asks them to refuse the message. pct= is historic — RFC 9989 receivers apply the stated policy. Google’s and Microsoft’s docs still show pct, so an existing pct is not an error and we will not flag it.
rua=mailto: is how you get aggregate XML reports (RFC 9990). Without rua you are flying blind: you cannot tell whether a failure is an attacker or a newsletter tool you forgot to authenticate. ruf= failure reports (RFC 9991) are optional and often unused because they can contain message snippets.
Safe rollout is mechanical. Publish p=none with rua (Monitoring Mode). For one to two weeks, fix every legitimate source that shows up unaligned (add them to SPF, or turn on that vendor’s DKIM, or stop them sending). Then raise policy with t=y — not a pct=25 staged rollout. t=y asks RFC 9989 receivers to apply one level below the stated policy: p=quarantine;t=y is treated as none, p=reject;t=y as quarantine. Omit t or set t=n to apply the stated policy. Going straight to reject is how people lock out their own invoicing mailbox.
np= sets policy for subdomains that do not exist in DNS — the lookalike hosts attackers invent. If you omit it, it inherits sp, then p. Two v=DMARC1 records at the same name are a lookup failure (RFC 9989). A CNAME from _dmarc to a reporting vendor is fine; we follow it and parse the TXT at the end. Timeouts and SERVFAIL are Unknown, not “no DMARC.”
This checker uses the same passive DMARC module as a Client Posture scan. We do not send mail, we do not touch the domain, and we never mark a timeout as a fail.
If you are an MSP showing this to a client, the useful sentence is not “you failed DMARC.” It is whether forged mail using their name would still be delivered. p=none means yes, it would. Quarantine means it should be junked. Reject means the receiving system is asked to refuse it. That is the conversation that turns a DNS record into a reason to hire you — and it is why this page shows the live record separately from the next-step TXT, with the Microsoft 365 or Google Workspace clicks when we can see those from MX. Live rua addresses are kept exactly; a missing rua is its own finding.
FAQ
- Does a DMARC record mean we are protected?
- Only if p= is quarantine or reject and t is not y. p=none with rua is Monitoring Mode: it collects data. It does not stop a lookalike invoice. An existing pct is historic, not a reason to say no.
- Will p=reject block our own mail?
- It blocks mail that fails both SPF alignment and DKIM alignment. If a vendor sends as you without being in SPF and without a DKIM signature that aligns, yes — that is the point of the monitor phase.
- Where do I put the record?
- A TXT at _dmarc.example.com, not on the apex. The host name is _dmarc; the value starts with v=DMARC1.
- Is this a penetration test?
- No. It is one DNS lookup, the same data anyone can query. Point-in-time, not a guarantee.
Fix this for your clients, white-labeled
Client Posture runs the same checks under your logo, with a branded PDF and a quote attached. MSPs use it to walk into the next meeting with evidence instead of a generic screenshot.