Instantly verify DMARC, SPF, DKIM, and MX records for any domain. See if your email is protected from spoofing.
Enter any domain name — we'll check DMARC, SPF, DKIM, and MX records.
Checking email authentication records…
DMARC (Domain-based Message Authentication, Reporting and Conformance) protects your domain from email spoofing and phishing. It tells receiving mail servers what to do with emails that fail authentication checks — without it, anyone can send emails pretending to be from your domain.
They're three different layers of email authentication that work together. SPF tells receiving servers which IP addresses are allowed to send email on behalf of your domain. DKIM adds a cryptographic signature to outgoing messages that receivers can verify. DMARC is the policy layer — it tells receivers what to do when SPF or DKIM checks fail, and where to send reports. You need all three for strong protection.
Yes — SPF and DKIM on their own don't tell receivers what to do with messages that fail authentication. DMARC fills that gap. It's also the only way to receive aggregate reports, which show you who's trying to send email as your domain — including both legitimate services you may have forgotten about and attackers attempting to spoof you.
Start with p=none — “monitor only, don't reject or quarantine anything yet, just send me reports.” It lets you see what's happening without breaking legitimate email. Once you've analysed the reports and confirmed everything legitimate is passing, move to p=quarantine (sends failures to spam), then p=reject (refuses them entirely). Going straight to reject can block legitimate email if your SPF or DKIM isn't fully configured.
DMARC records are published as TXT records in DNS, at the subdomain _dmarc.yourdomain.com. The record value is a semicolon-separated list of tags — minimum v=DMARC1; p=none; rua=mailto:[email protected] to get started. Your DNS provider's documentation will show you how to add a TXT record. Once it's published, our tool will validate it and tell you if anything's wrong.
That means “apply this policy to 100% of failing messages.” It's the default if you don't specify a percentage. You can set it lower (e.g. pct=25) when rolling out a stricter policy gradually — receivers will apply your policy to a quarter of failing messages and treat the rest as p=none. It's a good way to tighten policy without risking legitimate email all at once.
Aggregate reports (the rua tag) can go to a standard inbox, but they're machine-readable XML files that are hard to interpret by eye. In practice you'll want a dedicated DMARC reporting service to aggregate and visualise them. For small domains, the raw XML is usually enough to spot problems manually.
A failing SPF check means the email was sent from a server not listed in your SPF record. This could be a spoofed email, or it could be a legitimate service (like a CRM or newsletter tool) that you forgot to include. Check your SPF record includes all services that send email on your behalf.
Yes — completely free, no signup, no credit card, and no rate limits. We run it because we use it ourselves when setting up client domains and diagnosing deliverability problems. Ads on the page help cover hosting, but the tool itself will always be free to use.