🛡️ DMARC Record Checker

🖧
The selected healthy worker peer will originate this network request.
🛡️ DMARC Mode
🔍 Domain Lookup
📝 DMARC Parser
💡 Examples
Click to test domain:
Click to use template:
📋 Recent Checks
{{ item.timestamp }}
{{ item.type }}
⏳ Looking up DMARC...
Please wait while we lookup the DMARC record...
🔍 DNS Lookup Results
Domain: {{ results.domain }}
DMARC Domain: {{ results.dmarc_domain }}
DMARC Record Found: {{ results.dmarc_record ?'✅ Yes' :'❌ No' }}
DMARC Record:
{{ results.dmarc_record }}
⚠️ Multiple DMARC Records Found:
{{ record }}
Only one DMARC record should exist per domain
⚠️ {{ results.error }}
📊 DMARC Analysis
Record Status: {{ parsed.valid ?'✅ Valid' :'❌ Invalid' }}
Errors:
{{ error }}
Warnings:
{{ warning }}

Policy Strength

{{ getPolicyStrength(parsed).level.toUpperCase() }} {{ getPolicyStrength(parsed).description }}

DMARC Tags ({{ Object.keys(parsed.tags).length }})

{{ tagName }} {{ tag.value }}
{{ tag.valid ?'✅' :'❌' }}
{{ getTagDisplayName(tagName) }}: {{ tag.description }}
⚠️ {{ warning }}
ℹ️ DMARC Information

DMARC Records: Domain-based Message Authentication, Reporting & Conformance (DMARC) is an email authentication protocol that builds on SPF and DKIM to give domain owners the ability to protect their domain from unauthorized use.

DNS TXT Record: DMARC records are published as DNS TXT records at"_dmarc.domain.tld" that start with"v=DMARC1".

Email Security: DMARC provides policy enforcement and reporting capabilities to prevent email spoofing and improve email deliverability.

⚠️

ℹ️ About DMARC Record Checker

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication policy published as a DNS TXT record at _dmarc.example.com. It tells receiving mail systems what to do when a message fails SPF or DKIM alignment with the visible From: domain. Use this checker to look up a live domain policy or paste a record for syntax, tag, reporting, and enforcement review.

Common DMARC checks

DNS lookup

  • • Queries the public TXT record at _dmarc.<domain>
  • • Detects missing, malformed, or multiple DMARC records
  • • Shows the raw policy that receivers will evaluate
  • • Helps verify DNS changes after a rollout or provider migration

Record parser

  • • Splits semicolon-delimited DMARC tags into readable fields
  • • Checks required v and p tags
  • • Reviews SPF and DKIM alignment modes
  • • Flags weak rollout settings such as p=none or partial pct

Policy levels and rollout

p=none

Receiver action: Monitor only
Best use: Inventory legitimate senders
Risk: Does not block spoofed mail

p=quarantine

Receiver action: Treat failures as suspicious
Best use: Controlled enforcement step
Tip: Pair with pct for gradual rollout

p=reject

Receiver action: Reject failing messages
Best use: Mature SPF/DKIM alignment
Benefit: Strongest spoofing protection

Example records

Monitoring before enforcement

v=DMARC1; p=none; rua=mailto:[email protected]

Collect aggregate reports first so you can find mail streams that still need SPF or DKIM alignment.

Strict enforcement

v=DMARC1; p=reject; sp=quarantine; adkim=s; aspf=s; rua=mailto:[email protected]

Reject unauthenticated organizational-domain mail, quarantine subdomain failures, and require strict SPF/DKIM identifier alignment.

DMARC tags to review

Required tags

v - Version, normally DMARC1
p - Policy for messages that fail DMARC evaluation

Operational tags

sp - Separate policy for subdomains
rua - Aggregate report destination URIs
ruf - Failure report destination URIs
pct - Percentage of mail subject to enforcement
adkim / aspf - Relaxed or strict DKIM/SPF alignment
fo, rf, ri - Failure-reporting options, format, and interval

Practical limitations

  • DMARC depends on SPF or DKIM: A message can pass DMARC when either SPF or DKIM passes and the authenticated identifier aligns with the visible From domain.
  • DNS can lag: Receivers and recursive resolvers may cache old TXT answers until the record TTL expires.
  • Reporting is not guaranteed: Not every receiver sends reports, and rua/ruf mailboxes must be prepared for high-volume XML report traffic.
  • One record per policy location: Publishing more than one DMARC TXT record at the same _dmarc name can make the policy invalid for receivers.
  • This checker is diagnostic: It validates the published record and syntax, but it cannot prove that every legitimate sender signs DKIM correctly or uses an SPF-aligned envelope domain.

Source standards

DMARC behavior is specified in RFC 7489. Its alignment checks build on SPF from RFC 7208 and DKIM signatures from RFC 6376. The DNS TXT lookup used to publish DMARC policy follows the DNS resource-record model described in RFC 1035.

API Usage Example:

POST /api/tools/network/dmarc-record-checker
Content-Type: application/json

{
    "domain": "example.com",
    "action": "lookup"
}
Ready