About This Tool
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that ties SPF and DKIM together. While SPF controls who can send email and DKIM verifies message integrity, DMARC tells receiving mail servers what to do when messages fail these checks: monitor (p=none), quarantine (send to spam), or reject (block entirely). DMARC also provides a reporting mechanism where receiving servers send aggregate data about authentication results back to the domain owner, giving visibility into who is sending email as your domain — both legitimate senders and potential spoofers. This tool looks up the DMARC TXT record at _dmarc.domain.com, parses each policy tag, and checks for companion SPF and DKIM records.
How to Use
Enter a domain name and click "Look Up DMARC Record." The tool queries the _dmarc subdomain for TXT records, identifies the DMARC policy, and breaks down each tag with a plain-English explanation. The policy analysis section evaluates enforcement strength, coverage percentage, reporting configuration, subdomain handling, and alignment settings. The companion records section checks whether SPF and DKIM are also configured, since DMARC depends on at least one of them to be effective.
Tips & Best Practices
Start with p=none and an rua address to collect aggregate reports before enforcing. Review reports for 2-4 weeks to identify all legitimate senders, then move to p=quarantine, and finally p=reject. Use a DMARC report processing service to make the XML reports human-readable. Always set the rua tag — without it, you are flying blind. Set sp (subdomain policy) explicitly rather than relying on inheritance, especially if subdomains should not send email. The pct tag lets you gradually roll out enforcement by applying the policy to only a percentage of failing messages.