Free DMARC Checker
Enter any domain to see its DMARC record and what receiving mail servers are told to do with email that forges your address: refuse it, send it to spam, or deliver it normally. No account needed.
A DMARC checker reads the DMARC record published in your domain's DNS at _dmarc.yourdomain.com and shows what receiving mail servers do with forged email claiming to be from you. p=reject means it is refused, p=quarantine sends it to spam, and p=none delivers it normally.
Source: RFC 7489: Domain-based Message Authentication, Reporting and Conformance, published by IETF.
This tool reads public DNS records that domain owners publish for anyone to query, including the DMARC record at _dmarc.yourdomain.com. Results are a point in time snapshot from a public resolver: DNS is cached and can differ by location, so a change made in the last hour may not show yet. We check DNS configuration, not deliverability, and we cannot see your DKIM keys, because DKIM selectors are only discoverable from an actual signed message. Statistics quoted on this page come from our own sample of 1,200 domains drawn from the Tranco top 100,000, measured 13 August 2026. 1Lookup is an independent company and is not affiliated with any government agency, mailbox provider or standards body.
Need this at scale? Email Validation API
Validate addresses at scale with deliverability, disposable detection and fraud scoring on every lookup.
What a DMARC checker tells you
DMARC is a short text record in your domain's DNS that tells receiving mail servers what to do with email that claims to come from you but fails authentication. Without it, anyone can put your domain in the From line and the message usually lands in an inbox. This checker reads the record at _dmarc.yourdomain.com, translates the policy into plain English, and shows the raw record so you can see exactly what receivers are being told to do.
The policy value is the whole story. We sampled 1,200 domains from the Tranco top 100,000 on 13 August 2026: 42.1% had no valid DMARC record at all, and another 19.9% published p=none, which is monitoring only and stops nothing. That leaves 37.9% at enforcement, meaning quarantine or reject. If you set up DMARC and left it at p=none, forged mail claiming to be your domain still reaches the inbox. Having a record is not the same as being protected.
We also check the parts most tools skip. The sp tag sets a separate policy for subdomains, so a domain at reject can still leave mail.yourdomain.com wide open. A pct tag below 100 means the policy applies to only part of your failing mail. If your reports go to a different company's domain, that domain has to publish an authorization record or the reports are silently never sent: we measured 38 of 220 external setups, 17.3%, missing it.
How to check a DMARC record
Enter the domain
Type the domain you send email from, such as yourcompany.com. Pasting a full URL or an email address is fine, we strip the scheme, path and mailbox before checking. You can also enter a subdomain like mail.yourcompany.com if you want to know what policy applies to mail sent from that exact name.
We query DNS live
We look up the TXT records at _dmarc.yourcompany.com and keep only records that start with v=DMARC1, so a stray record or a zone wildcard cannot be misread as a policy. If that name has no record of its own, we fall back to your organizational domain using the Public Suffix List and label the result as inherited.
Read the plain English result
You get the policy in one sentence, the raw record, p and sp separately, the pct value if it is under 100, and whether reports are set up and authorized. If DNS times out or the domain's nameservers return errors, we say we could not check rather than reporting no record.
The policy in plain English first
reject means receivers are asked to refuse forged mail at the door. quarantine usually means the spam folder, at the receiver's discretion. none means the forgery is delivered normally and you only get reports. We lead with that sentence, then show the raw record for anyone who wants to read the tags themselves.
Subdomains shown separately
The sp tag sets the policy for subdomains and overrides p there. Plenty of domains are locked down at the root and wide open on every subdomain, which is exactly where invoice and billing spoofing lands. We print p and sp as two separate answers instead of one green badge.
The gaps other checkers skip
We flag pct below 100, which means the policy applies to only part of your failing mail, and we check whether your rua reporting address is authorized by the receiving domain. Of 220 external reporting setups we tested, 38 (17.3%) were missing that authorization, so those reports were silently never sent.
Found, missing, or could not check
A DNS timeout is not the same as no record, and we never blur the two. We also detect multiple DMARC records, which receivers treat as no DMARC at all: 0.8% of the 1,200 domains we sampled had that problem and were unprotected without knowing it.
Who uses this tool
Audit a client or vendor domain
MSPs and IT admins can check any domain without access to its DNS, because these records are public. Run a client's domains before an onboarding call and you know in seconds which ones sit at p=none, which have no record at all, and which leave subdomains exposed.
Find out why your email lands in spam
Marketers often discover the DMARC record is missing, sitting at none, or contradicted by a subdomain policy. Fixing that removes one clear reason receivers distrust your mail. It will not fix reputation or content problems, but it takes an avoidable failure off the table.
See who can spoof your domain
If someone can put your domain in the From line and still reach an inbox, invoice fraud and payroll scams get much easier. This shows whether receivers are being asked to refuse those messages, drop them in spam, or hand them over as normal mail.
Move from monitoring to enforcement
Most domains that have DMARC start at p=none while the owner finds every legitimate sender. Use this to confirm the record you published is live and reads the way you expect, then check again after each step: to quarantine, through a pct rollout, and finally to reject.
Frequently asked questions
What does this DMARC checker actually tell me?
It reads the TXT record at _dmarc.yourdomain.com and translates it. You get the policy in plain English, the raw record, the p value for the domain and the sp value for subdomains, the pct percentage if it is below 100, whether a rua reporting address is set, and whether external reporting is authorized. If there is no record, we say so rather than guessing.
Is p=none good enough?
No. p=none is monitoring only. Receivers send you reports about failures and then deliver the forged message anyway, usually straight to the inbox. It is a sensible first step while you find every legitimate sender, but it is not protection. In our 1,200 domain sample, 19.9% sat at p=none. Only quarantine, which sends forged mail to spam, and reject, which refuses it at the door, actually stop a spoofed email.
What is the difference between p and sp?
p sets the policy for the domain itself. sp sets it for subdomains only, and it overrides p there. If sp is missing, subdomains inherit p. This catches people out: a domain published as p=reject with sp=none tells receivers to refuse forged mail from yourdomain.com while delivering forged mail from billing.yourdomain.com normally. We show both values separately for that reason.
I checked a subdomain and got a policy back. Is it mine?
Sometimes. If a subdomain has no record of its own, it inherits from the organizational domain, and we label the result as inherited and name the domain it came from. Watch out on hosted names like yourapp.vercel.app or a blogspot.com address: the policy that applies there belongs to the platform, not to you. Some checkers report the platform's reject policy as if it were yours. We do not.
Does a good DMARC record mean my email reaches the inbox?
No. This checks DNS records, not inbox placement. DMARC tells receivers how to treat mail that fails authentication; it does not decide whether your legitimate mail is wanted. Reputation, content, list quality and sending volume drive that. A correct DMARC record removes one common reason for landing in spam and blocks people forging your domain, which protects your reputation over time, but it is not a deliverability fix on its own.
Is this free, and can I check a list of domains at once?
Yes, this page is free and rate limited to a handful of lookups per visitor per day, which keeps it fast for everyone. If you need to check a list of domains, create a free 1Lookup account: it includes a trial with bulk CSV processing, so you can run a whole customer or prospect list in one go. The 1Lookup API covers email, phone, IP and business verification.