DMARCChecker
Enter any domain to check its DMARC record. We validate your policy, inspect alignment settings, check reporting destinations, and flag anything that could leave your domain unprotected.
Check DMARC
Understanding Your DMARC Check
Here's what each result means and what to do next.
DMARC Pass
Your DMARC policy is properly configured and enforcing
A passing result means your DMARC record exists, your policy is actively protecting your domain, and your reporting is configured so you have visibility into authentication results. Make sure your SPF and DKIM records are also properly set up; DMARC depends on both.
- Valid DMARC record found
- Policy is set to quarantine or reject
- Aggregate reporting is configured
- SPF and DKIM alignment is set
Check Your SPF Next Check Your DKIM
DMARC Warning
Your record works but has issues worth fixing
A warning means your DMARC record exists and is syntactically valid, but it's not fully protecting your domain. The most common warning is p=none — which monitors authentication but doesn't take action on failures. This is a good starting point, but you need to progress to quarantine and then reject to actually stop spoofing.
- Policy is set to none (monitoring only)
- Missing aggregate or forensic reporting
- Subdomain policy not explicitly set
- Percentage tag is below 100%
DMARC Fail
Your DMARC configuration has issues that need to be fixed
A failing result means your domain has no DMARC protection — anyone can send email that appears to come from your domain, and receiving servers have no policy to enforce. The most common causes are a missing record, syntax errors, or duplicate DMARC TXT records. Each of these is fixable — review the details above for specific guidance.
- No DMARC record found
- Syntax errors in the DMARC record
- Multiple DMARC records on the same domain
- Invalid policy or tag values
Common DMARC Problems and How to Fix Them
These are the DMARC problems we see most often. If your check flagged any of these, here's what they mean and how to fix them.
Policy Stuck on None
The most common DMARC gap
The majority of domains with DMARC still have their policy set to p=none — which means they're collecting data but not actually protecting against spoofing. None is the right place to start, but staying there indefinitely gives you no more protection than having no DMARC at all. The path to enforcement requires reviewing aggregate reports, aligning all legitimate senders, then progressively tightening the policy.
- p=none only monitors — it doesn't block anything
- Spoofing and phishing continue uninterrupted
- Fix: review your reports, align senders, then move to quarantine
Missing Report Destinations
Flying blind on authentication
DMARC reporting is what makes the protocol actionable. Without aggregate reports (rua), you can't see which services are sending email as your domain or whether they're passing authentication. Without that data, you can't safely progress your policy — because you don't know what you'd break. Adding rua is the single most impactful first step.
- Without rua, you have no visibility into who's sending as your domain
- Without ruf, you can't diagnose individual authentication failures
- Fix: add a rua tag pointing to a mailbox or DMARC monitoring service
SPF or DKIM Alignment Failures
Passing auth but failing DMARC
DMARC doesn't just check whether SPF or DKIM pass — it checks whether the authenticated domain aligns with the From header domain. A message can pass SPF and DKIM but still fail DMARC if the domains don't match. This is especially common with third-party senders like marketing platforms and CRMs that use their own domains for the envelope sender or DKIM signature.
- SPF and DKIM can pass but still fail DMARC if alignment is off
- Third-party senders are the most common source of misalignment
- Fix: configure DKIM signing with your domain, or switch SPF to relaxed alignment
No DMARC Record Found
No protection at all
If no DMARC record exists for your domain, receiving servers have no way to know what you want them to do when SPF or DKIM fails. That means anyone can forge emails from your domain and there's no policy stopping them. Publishing even a basic p=none record with aggregate reporting is a significant improvement — it gives you visibility and signals to receivers that you're working on authentication.
- Without DMARC, receivers have no policy to enforce
- Your domain is fully exposed to spoofing and phishing
- Fix: publish a DMARC TXT record at _dmarc.yourdomain.com
Why DMARC Matters for Your Business
DMARC is the policy layer that actually stops email spoofing. Without it, SPF and DKIM are suggestions, not enforcement.
Your Domain Gets Used in Phishing Attacks
Without DMARC enforcement, attackers can send emails that appear to come from your domain, targeting your clients, vendors, and employees. You won't even know it's happening until someone reports it.
Legitimate Emails Land in Spam
Major inbox providers like Google and Yahoo now require DMARC for bulk senders. Without a valid record, your marketing emails, transactional messages, and even internal communications can be deprioritized or filtered.
You Have No Visibility Into Your Email
Without DMARC reporting, you can't see who's sending email as your domain. Shadow IT, forgotten services, and unauthorized senders go undetected until they cause a deliverability or security incident.
Compliance and Insurance Requirements
Cyber insurance underwriters and compliance frameworks like SOC 2, HIPAA, and CMMC increasingly expect DMARC enforcement. A missing or weak DMARC policy can complicate renewals, audits, and vendor questionnaires.
Check Your Full Email Authentication with iO™ DMARC
SPF is one piece of the puzzle. Use these tools to check the rest of your email authentication stack.
SPF Checker
Validate your SPF record and confirm which servers are authorized to send on your behalf. DMARC relies on SPF alignment to verify the envelope sender.
DKIM Checker
Verify your DKIM signature to make sure outgoing emails are cryptographically signed. DMARC uses DKIM alignment to verify message integrity.
BIMI Checker
See if your domain qualifies to display your brand logo in supported inboxes. BIMI requires a DMARC policy of quarantine or reject to be eligible.
MTA-STS Checker
Check whether your domain enforces encrypted email delivery. MTA-STS protects the transport layer, while DMARC protects the authentication layer.
TLS-RPT Checker
Verify your TLS reporting setup. Just like DMARC gives you authentication reports, TLS-RPT gives you visibility into encrypted delivery failures.
Email Authentication Audit
Get a complete picture of your SPF, DKIM, DMARC, BIMI, and MTA-STS configuration in one report. See what’s working, what’s broken, and what to fix first.