DMARC checker

Purpose

Check a domain’s DMARC record: its policy (none, quarantine or reject), whether it comes from a parent domain, the share of email it applies to, the alignment and where the reports go.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

DMARC tells receiving servers what to do with an email that claims to come from a domain but fails its checks: deliver it, send it to spam or reject it. Type a domain, an email address or a link and we’ll show you its DMARC policy and what it means.

How to use it

1. 1

   Type the domain you want to check, or paste an email address or a link: we only use its domain.

2. 2

   Press “Check DMARC”. We look for its record at _dmarc and, if there’s none, at its parent domains, as receiving servers do.

3. 3

   Look at the policy: “reject” or “quarantine” on 100% of the email protects the domain; “none” only monitors.

Synthetic example

v=DMARC1; p=reject; rua=mailto:[email protected]

Interpret the result

This domain has no DMARC: It doesn’t ask receivers to stop email that pretends to come from it, which makes it easier to impersonate.

The DMARC record has errors: Receivers may ignore it, which leaves the domain as if it had no DMARC. The signals below say what’s wrong.

DMARC only monitors: The policy is “none”: the domain gets reports, but fake email in its name is still delivered.

DMARC protects only part of the email: The policy applies to a share of the email that fails; the rest is delivered as if there were no policy.

Fake email goes to spam: The policy is “quarantine”: receivers send email that fails the checks to the spam folder.

Fake email is rejected: The policy is “reject”: receivers refuse email that pretends to come from this domain. It’s the strongest protection.

none: monitor only

quarantine: send to spam

reject: refuse delivery

Limitations

Troubleshooting

That doesn’t look like a public domain. Try something like example.com.

DNS didn’t answer in time. Try again in a few seconds.

You’ve run a lot of checks in a row. Wait a minute and try again.

Use with the API

A domain’s DMARC policy (RFC 7489, with the DMARCbis walk up to parent domains): the record, where it was found, the effective policy (none, quarantine or reject), the percentage, the DKIM and SPF alignment and the domains that receive the reports, never a full address. Nothing is stored.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/dmarc-check
POST https://api.nocall.io/v2/tools  {"tool":"dmarc-check","domain":"example.com"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/dmarc-check' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"domain":"example.com"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/dmarc-check',
    method='POST',
    data=json.dumps({'domain': 'example.com'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/dmarc-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ domain: 'example.com' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "dmarc-check",
    "result": {
      "domain": "example.com",
      "domainAscii": "example.com",
      "found": true,
      "record": "v=DMARC1; p=none; rua=mailto:[email protected]",
      "foundAt": "example.com",
      "inherited": false,
      "policy": "none",
      "subdomainPolicy": null,
      "effectivePolicy": "none",
      "percentage": 100,
      "alignment": {
        "dkim": "relaxed",
        "spf": "relaxed"
      },
      "reports": {
        "aggregate": [
          "example.com"
        ],
        "failure": []
      },
      "signals": [
        "policy_none"
      ],
      "valid": true,
      "attention": true
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• SPF record checker
• DKIM checker
• Is this email real?