Free DMARC checker
DMARC checker: is your domain protected?
Type your domain. We read your DMARC record, plus SPF and DKIM, and tell you in plain English what it does and the exact record to add if something is missing.
Check your DMARC record
Free, no signup. Reads public records only, nothing is stored.
What DMARC does
DMARC tells inboxes what to do with mail that fails SPF and DKIM, and where to send reports about it. To pass, a message has to pass SPF or DKIM, and the domain that passed has to match the From address.
Gmail requires a DMARC record from anyone sending more than 5,000 messages a day to Gmail accounts. A policy of p=none meets that rule.
What your result means
- No DMARC record. Inboxes get no instructions, you get no reports, and little stops someone sending email as your domain.
- p=none. You collect reports but nothing is blocked. A good first step, but it doesn't stop fakes.
- p=quarantine. Mail that fails goes to spam. Your domain is partly protected.
- p=reject. Mail that fails is refused. Full protection, as long as all your real senders pass.
- No rua address. You get no reports, so you can't see who is sending as you.
A safe starting record
Add this as a TXT record at your DNS provider.
Name: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com
Use a mailbox you read, or a DMARC report service, for the rua address. Leave it at p=none until reports show all your real email passing.
How to fix "DMARC policy not enabled"
01
Publish p=none with reports
The record above. It starts the reports without risking your own mail.
02
Read the reports
Give it a few weeks. Find every service sending as you, real or not.
03
Fix SPF and DKIM for each real sender
One SPF record that covers them all, and DKIM switched on in each service.
04
Move to quarantine
Once your real mail passes, failing mail starts going to spam.
05
Move to reject
When reports stay clean, fakes are refused outright.
Why not jump straight to reject?
If a real sender, like your CRM or invoicing tool, isn't set up yet, p=reject blocks your own email. That's why we move in steps, and why our fix runs over 30 to 45 days.
Questions
- Is p=none good enough?
- It meets Gmail's bulk sender rule and gets you reports. It doesn't stop anyone faking your domain. Treat it as a first step.
- Where do I add a DMARC record?
- At your DNS provider, wherever you manage your domain's records, such as Cloudflare, GoDaddy or Squarespace.
- Can I have more than one DMARC record?
- No. Publish one TXT record at _dmarc. With two, inboxes treat your domain as if it has none.
- Does this checker store my domain?
- No. It reads public DNS records only, and nothing is stored.
Want it done for you?
We fix your email health for a fixed price, from $249.
We find every service that sends email as you, fix SPF and DKIM for each one, and move DMARC to blocking fakes once your real mail passes. You keep every account.