DMARC Analyzer

Analyze and validate your domain's DMARC record configuration.

Email Authentication

Analyze a DMARC record

Check syntax, enforcement policy, alignment mode, reporting endpoints, and common misconfigurations in one view.

DNS TXT _dmarc Validation

Domain name

Enter the root domain only. Example: example.com

Run a DMARC check

Start with a domain to inspect enforcement mode, reporting setup, alignment strategy, and validation issues.

Syntax validation

Checks required tags and invalid values.

Policy analysis

Reviews p, sp, pct, adkim and aspf tags.

Reporting checks

Shows aggregate and forensic report targets.

DMARC summary

Policy

Subdomain

Coverage

Latency

DKIM Alignment

SPF Alignment

Aggregate Reports

Failure Reports

result.log

Parsed tags

Findings

Recommendations

Diagnostic steps

What is DMARC?

DMARC helps domain owners tell receiving mail servers how to handle messages that fail SPF or DKIM checks.

It also enables reporting, so you can see who is sending mail on behalf of your domain and tighten policy over time.

Policy modes

none

Monitor only. No enforcement action.

quarantine

Suspicious mail may go to spam or junk.

reject

Failing mail should be rejected outright.

Important tags

Main policy

none / quarantine / reject

Subdomain policy

optional

pct

Enforcement percentage

0-100

adkim / aspf

Alignment mode

r or s

rua / ruf

Reporting mailboxes

mailto:

Learn more & FAQ

What does a DMARC analyzer do?

DMARC is the policy that tells receiving mail servers what to do with messages that fail SPF or DKIM - and whether to send you reports about it. This tool looks up your domain's DMARC record, parses every tag in it, and explains what each one actually does, so you can confirm your policy says what you think it says.

How to read your results

The policy (p=) tag is the headline result - none, quarantine, or reject. Alongside it you'll see the reporting addresses (rua/ruf), the alignment mode for SPF and DKIM, and the percentage of mail the policy applies to (pct). A missing record, or a policy stuck at p=none long after setup, are the two most common issues this tool flags.

Frequently asked questions

What is DMARC and how does it relate to SPF and DKIM?

DMARC sits on top of SPF and DKIM: it tells receiving mail servers what to do (none, quarantine, or reject) when a message fails those checks, and where to send reports about it. Without a DMARC record, receiving servers have no policy to enforce even if SPF or DKIM fails.

What's the difference between DMARC policies p=none, p=quarantine, and p=reject?

p=none takes no action and only collects reports - useful while you're still setting things up. p=quarantine sends failing mail to spam. p=reject blocks failing mail outright. Most domains should work toward p=reject once they've confirmed legitimate mail isn't being caught.

Why would I need a DMARC record if I have no domain configured for email?

Even domains that never send email are worth protecting with a p=reject DMARC record - otherwise nothing stops someone from spoofing your domain in phishing emails to third parties, since there's no sending infrastructure to misconfigure in the first place.

What are DMARC aggregate (rua) and forensic (ruf) reports?

Aggregate reports (rua) are periodic summaries from mail providers showing which servers sent mail claiming to be from your domain and whether it passed authentication. Forensic reports (ruf) cover individual failed messages in more detail, though far fewer providers send them today.

I just published a DMARC record - why doesn't this tool see it yet?

DNS changes take time to propagate across resolvers worldwide. Use the Propagation Checker to confirm the record has gone live everywhere before assuming something is wrong with the record itself.