DMARC checker

Bookmark

Look up your DMARC DNS records and analyze for errors.

Check your DMARC record is valid and correct

Live DNS lookup

Run a live DMARC DNS lookup to verify the record receivers use, catch syntax issues, and confirm the policy protects your domain. For ongoing visibility, use Suped's DMARC monitoring to track reports, senders, and authentication failures over time. When you are editing a record, compare the DMARC tags and DMARC policy examples before publishing.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

One DMARC checker, endless uses

Use the DMARC checker to validate a new domain, audit a sender before launch, inspect a client's DNS, or confirm a record change after propagation. It turns raw DNS into a readable report so you can catch missing records, unsafe policies, reporting gaps, and authorization issues before they affect real mail.

DNS record

_dmarc.example.com

TXTv=DMARC1; p=reject

Live DMARC DNS lookup

Check the exact TXT record receivers read at _dmarc before you rely on it.

Record found

Single record

Record valid

Syntax and duplicate checks

Catch malformed tags, invalid values, and multiple records that can make DMARC fail.

p=nonequarantinereject

Policy readiness

See whether your domain is only monitoring or ready to quarantine and reject spoofed mail.

DMARC reports

rua=mailto:dmarc@

ruf=mailto:alerts@

Reporting configuration

Confirm aggregate and failure report destinations are published where receivers expect them.

DNS provider

Managed in Vercel

DNS provider context

Identify where the record is managed so the right team can make the fix.

Shareable report

Copy link

Shareable results

Send the same report to a client, vendor, or teammate without screenshots or guesswork.

DMARC checker FAQs

Answers to common questions about validating a DMARC record, reading the results, and deciding what to fix next.

No. It performs a live DNS lookup and reports what is currently published.

It checks whether DNS returns a DMARC TXT record at _dmarc.yourdomain.com. A sending domain should publish one record that starts with v=DMARC1 so receivers know what policy to apply to messages that fail authentication.

DMARC allows one policy record per domain. If multiple DMARC TXT records are published at _dmarc, receivers can discard them, which leaves the domain without an effective DMARC policy.

A valid record starts with v=DMARC1, includes a valid p= policy tag, uses supported tag names and values, and separates tags with semicolons. If the syntax is wrong, receivers may ignore the record.

Use quarantine or reject once legitimate senders pass SPF or DKIM alignment. Start with none if you still need to observe traffic safely.

The sp= tag controls DMARC handling for subdomains. If sp= is missing, subdomains inherit the main p= policy. If sp=none is published, spoofed subdomain mail can remain in monitoring only.

The rua= tag tells receivers where to send aggregate DMARC reports. Without rua reporting, you cannot see which services send mail for the domain, which sources fail, or whether it is safe to enforce a stricter policy.

When DMARC reports are sent to an address on another domain, that destination domain must authorize it with a DNS TXT record. Without authorization, receivers may drop reports for that external address.

The standalone DMARC checker validates DNS records. To see whether a real message passed DMARC, SPF, DKIM, alignment, and related delivery checks, use the email tester.