DMARC checker

Bookmark

Use this free DMARC checker tool to look up your domain's record and check its syntax, policy and reporting settings.

Check your DMARC record is valid and correct

Live DNS lookup

Use this DMARC checker tool to look up your published policy, catch syntax and duplicate-record errors, and check reporting destinations. For ongoing visibility, use Suped's DMARC monitoring to track reports, senders, and authentication failures over time. When you are editing a record, compare the DMARC tags and DMARC policy examples before publishing.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

How to verify a DMARC record with a DNS lookup

Enter your sending domain to look up its DMARC TXT record. In this example, p=none requests monitoring and rua names the aggregate-report destination.

_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Understand the DMARC tags in your record.

DMARC checker results: missing records and reporting errors

Publish a missing record at _dmarc or consolidate duplicates. Confirm external rua authorization, and review legitimate traffic before enforcement; a DNS check alone cannot show sender readiness.

Build a DMARC record to publish in DNS.

What the DMARC record checker tests

Inspect the DNS configuration receivers use: record syntax, policy, subdomain handling and reporting authorization. A valid DNS record does not prove that a particular email passes DMARC or that every legitimate sender is ready for enforcement.

DNS record

_dmarc.example.com

TXTv=DMARC1; p=reject

Live DMARC DNS lookup

Check the exact TXT record receivers read at _dmarc before you rely on it.

Record found

Single record

Record valid

Syntax and duplicate checks

Catch malformed tags, invalid values, and multiple records that can make DMARC fail.

p=nonequarantinereject

Published DMARC policy

See whether the published policy requests monitoring, quarantine or rejection of mail that fails DMARC.

DMARC reports

rua=mailto:dmarc@

ruf=mailto:alerts@

Reporting configuration

Confirm aggregate and failure report destinations are published where receivers expect them.

DNS provider

Managed in Vercel

DNS provider context

Identify where the record is managed so the right team can make the fix.

Shareable report

Copy link

Shareable results

Send the same report to a client, vendor, or teammate without screenshots or guesswork.

DMARC checker FAQs

Answers to common questions about validating a DMARC record, reading the results, and deciding what to fix next.

No. It performs a live DNS lookup and reports what is currently published.

It checks whether DNS returns a DMARC TXT record at _dmarc.yourdomain.com. A sending domain should publish one record that starts with v=DMARC1 so receivers know what policy to apply to messages that fail authentication.

DMARC allows one policy record per domain. If multiple DMARC TXT records are published at _dmarc, receivers can discard them, which leaves the domain without an effective DMARC policy.

A valid record starts with v=DMARC1, includes a valid p= policy tag, uses supported tag names and values, and separates tags with semicolons. If the syntax is wrong, receivers may ignore the record.

Start with none while reviewing legitimate sending traffic. Move toward quarantine or reject after confirming that legitimate mail passes aligned SPF or DKIM. The checker shows the published policy, not whether all your senders are ready for enforcement.

The sp= tag controls DMARC handling for subdomains. If sp= is missing, subdomains inherit the main p= policy. If sp=none is published, spoofed subdomain mail can remain in monitoring only.

The rua= tag requests aggregate reports from participating receivers. Reviewing those reports helps identify sending services, authentication failures and enforcement risks. A published rua address does not prove that reports are being received or reviewed.

When DMARC reports are sent to an address on another domain, that destination domain must authorize it with a DNS TXT record. Without authorization, receivers may drop reports for that external address.

The standalone DMARC checker validates DNS records. To see whether a real message passed DMARC, SPF, DKIM, alignment, and related delivery checks, use the email tester. Test DMARC authentication on a real email.