DMARC checker: is this domain protected against impersonation?
DMARC tells receiving servers what to do with an email that claims to come from a domain but fails its checks: deliver it, send it to spam or reject it. Type a domain, an email address or a link and we’ll show you its DMARC policy and what it means.
How to use it
- Type the domain you want to check, or paste an email address or a link: we only use its domain.
- Press “Check DMARC”. We look for its record at _dmarc and, if there’s none, at its parent domains, as receiving servers do.
- Look at the policy: “reject” or “quarantine” on 100% of the email protects the domain; “none” only monitors.
What each result means
- This domain has no DMARC
- It doesn’t ask receivers to stop email that pretends to come from it, which makes it easier to impersonate.
- The DMARC record has errors
- Receivers may ignore it, which leaves the domain as if it had no DMARC. The signals below say what’s wrong.
- DMARC only monitors
- The policy is “none”: the domain gets reports, but fake email in its name is still delivered.
- DMARC protects only part of the email
- The policy applies to a share of the email that fails; the rest is delivered as if there were no policy.
- Fake email goes to spam
- The policy is “quarantine”: receivers send email that fails the checks to the spam folder.
- Fake email is rejected
- The policy is “reject”: receivers refuse email that pretends to come from this domain. It’s the strongest protection.
What each signal means
- The domain publishes no DMARC record, and neither do its parent domains.
- There’s more than one DMARC record. Only one is allowed, so receivers apply none of them.
- The record has an error, such as a policy that doesn’t exist, so receivers may ignore it.
- The policy is “none”: it only asks for reports, and fake email is still delivered.
- The policy only applies to part of the email that fails (pct below 100).
- It asks for no reports (rua), so the domain’s owner doesn’t learn who sends email in its name.
- The domain has no record of its own: the record of a parent domain applies.
- The policy for subdomains (sp) is weaker than the main one.
Related tools
Which countries it covers
Works with domains from any country. We look for the record as receiving servers do: at the domain itself and, if it has none, at its parent domains (up to five levels). Report addresses are only shown by their domain.
We read the domain’s public DNS records. If you type an email address or a link, only its domain leaves your browser. The domain you look up isn’t stored.
Frequently asked questions
What is DMARC?
Domain-based Message Authentication, Reporting and Conformance: a DNS record that tells receivers what to do with email that uses a domain in “From” but fails SPF and DKIM. It also asks for reports, so the owner can see who sends email in the domain’s name.
What do none, quarantine and reject mean?
“none” only monitors: email is delivered as usual and the owner gets reports. “quarantine” sends email that fails to spam. “reject” refuses it. Domains usually start with “none”, read the reports and work their way up to “reject”.
If a domain has DMARC, is all its email genuine?
No. DMARC makes it hard to use that exact domain in “From”, but a scammer can register a look-alike domain with its own DMARC. Check the sender’s domain letter by letter, or paste the headers into “Is this email real?”.
Why does it say the record is inherited?
A subdomain without a record of its own (mail.example.com) uses the one of its parent domain (example.com), with the subdomain policy (sp) if it has one.