Skip to content
Aback Tools Logo

DMARC Record Checker

Check the DMARC record for any domain instantly with our free DMARC Record Checker. Queries the _dmarc TXT record via Cloudflare's DNS-over-HTTPS API and analyses the full DMARC policy configuration including policy level, alignment settings, and reporting addresses - no signup required.

DMARC Record Checker

Check the DMARC record for any domain. Queries the _dmarcTXT record via Cloudflare's DNS-over-HTTPS API and analyses the policy (none, quarantine, reject), alignment settings, and reporting configuration. Results include DNSSEC validation status.

Enter a domain name - the tool queries _dmarc.yourdomain.com

Try:
About DMARC
  • DMARC builds on SPF and DKIM to prevent email spoofing and domain impersonation
  • The DMARC record is published as a TXT record under _dmarc.yourdomain.com
  • Start with p=none to monitor, then move to p=quarantine, then p=reject
  • Always configure rua= reporting to receive authentication reports
  • Queries are sent via Cloudflare DNS-over-HTTPS - no data stored on our servers

Why Use Our DMARC Record Checker?

Real-Time DMARC Record Lookup

Query the _dmarc TXT record for any domain instantly via Cloudflare's DNS-over-HTTPS API. Our tool parses and displays all DMARC tags including policy (p=), subdomain policy (sp=), percentage (pct=), alignment modes (adkim, aspf), and reporting addresses (rua, ruf).

DMARC Policy Analysis & Validation

Get instant analysis of your DMARC policy configuration. Each tag is explained with its current value, and the tool provides recommendations for improving your email authentication posture based on industry best practices and current DMARC specifications.

Private & Secure DNS Queries

All DMARC record queries are sent directly from your browser to Cloudflare's DNS-over-HTTPS endpoint over an encrypted HTTPS connection. No query data is stored on our servers - your domain lookups are completely private and secure.

Free DMARC Record Checker Online

Use our DMARC record checker directly in your browser with no downloads, no plugins, and no account required. Check DMARC records for any domain from any device, anytime, with zero usage limits. Results include full tag reference documentation.

Common Use Cases for DMARC Record Checker

Email Authentication Audit

Check your domain's DMARC record to ensure it is correctly configured for email authentication. Verify the policy is set to p=quarantine or p=reject for proper protection against email spoofing and phishing attacks targeting your domain.

Domain Protection for Businesses

Businesses can use the DMARC record checker to verify their domain is protected against email impersonation. Check that reporting addresses (rua/ruf) are configured to receive aggregate and forensic reports about authentication failures.

Email Deliverability Optimization

Verify that your DMARC record is properly configured to avoid email delivery issues. Check alignment settings (adkim, aspf) to ensure legitimate emails pass authentication and reach your recipients' inboxes rather than spam folders.

DMARC Policy Migration Planning

When moving from p=none to p=quarantine or p=reject, use the DMARC checker to verify your current configuration before making changes. Check that reporting is set up to monitor the impact of policy enforcement.

Learning Email Security

IT professionals and students learning about email security can use the DMARC checker to examine real-world DMARC records from major domains. Understand how different organizations configure their email authentication policies.

DNS Configuration Verification

After adding or updating a DMARC TXT record in your DNS, use the checker to verify the record is published correctly. Confirm all DMARC tags (v, p, pct, rua, ruf, sp, adkim, aspf, fo) are properly formatted.

Understanding DMARC Records

What Is a DMARC Record?

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that builds on SPF and DKIM to give domain owners control over how email receivers handle messages that fail authentication. A DMARC record is a TXT record published in the DNS under the _dmarc subdomain (e.g. _dmarc.example.com).

DMARC records specify a policy for unauthenticated email (none, quarantine, or reject), define alignment requirements for SPF and DKIM, and provide reporting addresses where email receivers send aggregate and forensic reports. DMARC helps prevent email spoofing, phishing, and domain impersonation by telling receiving mail servers what to do with messages that fail authentication checks.

How Our DMARC Record Checker Works

Our DMARC record checker performs a live DNS lookup and analyses the record in real time:

  1. Enter a domain name - Type any domain name (e.g. google.com) into the input field. The tool automatically queries the _dmarcsubdomain for that domain via Cloudflare's DNS-over-HTTPS API.
  2. DMARC record parsing - The tool parses all DMARC tags from the TXT record value: the mandatory v=DMARC1 version tag and p= policy tag, plus optional tags for percentage (pct=), reporting addresses (rua=, ruf=), subdomain policy (sp=), alignment (adkim=, aspf=), failure reporting (fo=), and reporting interval (ri=).
  3. Analysis & recommendations - Each tag is displayed with its value, and the tool provides analysis of your DMARC configuration, including whether your policy provides adequate protection and whether reporting is configured.

DMARC Tags Explained

  • v=DMARC1 - DMARC version. Must be present and set to DMARC1. This identifies the record as a DMARC record.
  • p=none, p=quarantine, or p=reject - The policy tells email receivers what to do with unauthenticated email:none (monitor only, no action),quarantine (mark as spam), or reject (block the email).p=reject is the strongest protection.
  • rua=mailto:... - Aggregate reporting URI. Where email receivers send daily XML reports summarizing authentication results. Multiple addresses can be specified, separated by commas.
  • ruf=mailto:... - Forensic (failure) reporting URI. Where email receivers send detailed individual failure reports. Forensic reports contain the original email headers and are useful for troubleshooting.
  • sp=none|quarantine|reject - Subdomain policy. Specifies the policy for subdomains if different from the main domain policy. If not set, subdomains inherit the main domain policy.
  • adkim=r|s - DKIM alignment mode. r (relaxed) allows the organizational domain to be different from the DKIM signing domain.s (strict) requires an exact match.
  • aspf=r|s - SPF alignment mode. r (relaxed) allows the organizational domain to be different from the SPF return-path domain.s (strict) requires an exact match.

Privacy, Security & Availability

Your privacy is our priority. All DMARC record queries are sent directly from your browser to Cloudflare's DNS-over-HTTPS endpoint over an encrypted HTTPS connection. No query data is stored, logged, or processed on our servers - your domain lookups are completely private. The tool is completely free with no signup required, no usage limits, and no hidden restrictions. Use it confidently for personal projects, business email security audits, or learning about email authentication.

Related Tools

DNS Leak Test

Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.

DNS Record Comparator

Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.

Reverse DNS Lookup

Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.

Cookie Security Checker

Paste any Set-Cookie header value and analyze its security configuration against best practices. Validates Secure flag, HttpOnly flag, SameSite policy (Strict/Lax/None), Expires/Max-Age validity, Path and Domain scope. Get a 0-100 security score per cookie with specific warnings and actionable recommendations - free online cookie security checker.

Frequently Asked Questions About DMARC Records

A DMARC (Domain-based Message Authentication, Reporting & Conformance) record is a DNS TXT record published under the _dmarc subdomain of your domain. It tells email receivers what to do with messages that fail SPF or DKIM authentication checks. DMARC records specify a policy (none, quarantine, or reject), define alignment requirements, and provide reporting addresses where email receivers send authentication reports.

DMARC has three policy levels: p=none (monitoring only - no action taken on unauthenticated email, but reports are sent), p=quarantine (unauthenticated email is marked as spam and sent to the recipient's spam folder), and p=reject (unauthenticated email is rejected outright and never reaches the recipient). Most security experts recommend starting with p=none to monitor your email traffic, then moving to p=quarantine and finally p=reject as you confirm all legitimate email is authenticated.

Enter your domain name (e.g. example.com) into the DMARC Record Checker above and click "Check DMARC Record". The tool automatically queries _dmarc.yourdomain.com and displays all DMARC tags with their values. If no DMARC record is found, your domain does not have DMARC configured, which means it is vulnerable to email spoofing and impersonation attacks.

DMARC alignment ensures that the domain in the From header of an email matches the domain used in SPF and DKIM authentication. adkim= (DKIM alignment) can be r (relaxed) or s (strict). With relaxed alignment, the organizational domain must match. With strict, an exact domain match is required. aspf= (SPF alignment) works the same way. Alignment prevents attackers from using your domain in the From header while authenticating with their own SPF/DKIM.

rua (Aggregate Reporting URI) specifies where email receivers send daily XML reports summarizing all authentication results for your domain. These reports show how many emails passed or failed SPF, DKIM, and DMARC checks. ruf (Forensic Reporting URI) specifies where detailed individual failure reports are sent. Forensic reports contain the full headers of unauthenticated emails and are useful for troubleshooting specific failures.

Always start with p=none (monitoring mode). This allows you to collect DMARC reports and understand your email landscape without affecting email delivery. After monitoring for 2-4 weeks and confirming all legitimate email is authenticated via SPF and DKIM, move to p=quarantine. After another monitoring period, move to p=reject for maximum protection. Starting with p=reject can cause legitimate email to be blocked if your SPF/DKIM configuration is incomplete.

Yes! Our DMARC Record Checker is 100% free with no signup required, no account needed, and no usage limits. All queries are sent directly from your browser to Cloudflare's DNS-over-HTTPS API. No query data is stored or logged on our servers. Use it for personal projects, business email security audits, or learning about email authentication.