See whether a domain stops forged mail.
Type a domain or an email address. The checker reads its DMARC record the way receiving mail servers do: the policy, the reports, the parent domain's record when there is none, and everything that keeps the policy from working.
DMARC for paypal.com
Policy: reject
_dmarc.paypal.com
TXT _dmarc.paypal.com
v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email
- v=DMARC1
- Marks the record as DMARC.
- p=reject
- Receivers refuse mail that fails DMARC.
- rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email
- Where receivers send the daily aggregate reports.
- ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email
- Where receivers send reports on single failed messages; few receivers still send them.
DMARC passes when SPF or DKIM passes for the sender's own domain. Check them with the SPF checker and the DKIM checker, and where the domain receives mail with the MX lookup.
Behind every check
- 24.6 million
- IP addresses profiled
- 2.7 million
- malicious domains tracked
- 228,000
- disposable email domains
- 2.3 million
- networks scored
Counts read live from the engine, not written into the page. The full dataset is published on GitHub under the MIT license and rebuilt every 30 minutes.
What DMARC does
DMARC lets a domain tell receiving mail servers what to do with mail that claims to come from it but fails authentication. A message passes when SPF or DKIM passes for a domain that matches the one in the From line people see. The policy decides the rest: none delivers it anyway, quarantine sends it to spam, reject refuses it. Receivers also send reports back, so the domain's owner sees the servers that send mail in its name.
p
The policy for the domain: none, quarantine or reject.
sp
The policy for its subdomains, when it differs.
rua
The address that receives the daily aggregate reports.
pct
The share of failing mail the policy applies to, 100 when absent.
adkim and aspf
How closely the DKIM and SPF domains have to match the From domain: relaxed allows a subdomain, strict needs the exact name.
From none to reject
Start with p=none and a rua address, and read the reports for a few weeks: they show the services that send your mail, including the ones nobody remembered. Fix SPF and DKIM for each of them, then move to quarantine, then to reject. Mailbox providers expect a record: Google has required one since February 2024 from anyone sending 5,000 or more messages a day to Gmail, and Yahoo asks the same of bulk senders.
DMARC and fraud
Without an enforced DMARC policy, anyone can send mail with your domain in the From line, and many receivers will deliver it. That is how invoice fraud and fake password resets borrow a real company's name. A reject policy stops exact-domain forgeries at every receiver that enforces DMARC. Look-alike domains need other defenses, such as watching for newly registered domains that imitate yours.
Questions people ask.
A tool that reads a domain's DMARC record and explains it: the policy receivers apply, where the reports go, and any error that makes receivers ignore the record. Type a domain above to check one.
none only asks for reports, and failing mail is delivered as usual. quarantine asks receivers to put failing mail in spam. reject asks them to refuse it. Each applies only to mail that fails both SPF and DKIM alignment.
As a first step, yes. With none, forged mail in your name is still delivered, so it protects nothing yet. It is the right start while the reports show who sends your mail, and Google's sender rules accept it, but the goal is quarantine or reject.
A subdomain without a DMARC record of its own falls under its organizational domain's record, and the sp= tag sets its policy when present. The checker shows which record applies and says so when it is inherited.
Check the rua address first. When it sits at another domain, that domain has to publish a record agreeing to take your reports, at yourdomain._report._dmarc.theirdomain; without it, receivers drop them. The checker tests this for every report address.
At least one of them has to pass for the From domain, and having both makes delivery sturdier: forwarding breaks SPF, while DKIM signatures usually survive it.
Other free tools.
SPF checker
Check a domain's SPF record, the DNS lookups it needs against the limit of 10, and the mistakes that make it fail.
OpenDKIM checker
Find a domain's DKIM keys under the common selectors or your own, and check their type, length and status.
OpenMX lookup
See a domain's MX records, the mail service behind them, and whether FFraud lists the domain as disposable.
OpenDo it in code.
The same answer from a free API endpoint, with the reason, the recency and the network around the address. Or download the confirmed blocklist for bulk blocking. No card, no quota, no expiry.