DMARC checker
With the DMARC Checker tool, you can look up a domain's DMARC record, policy, and alignment settings to confirm your email authentication is valid.
What is a DMARC checker?
A DMARC checker is a diagnostic lookup tool that queries your DNS TXT records to translate complex email authentication policies into a clear, readable format. Instead of relying on command-line utilities, administrators use this feature to instantly verify how receiving servers handle messages that fail SPF and DKIM evaluations.
By analyzing the domain, security teams gain direct visibility into enforcement actions, alignment rules, and reporting configurations. This specialized record checker simplifies the technical process of securing outbound email, ensuring that your communications remain protected against spoofing while maintaining reliable deliverability.
How does a DMARC checker work?
When you input a web address into our DMARC checker tool, it initiates a live DNS query targeting the designated TXT entry. Executing this real-time DMARC lookup retrieves the exact policy string and translates each individual tag, showing administrators precisely what receiving mail servers evaluate upon message arrival. Because the results are never cached, you can confidently check DMARC record updates the moment they’re published.
This evaluation serves as a core component of a comprehensive SPF DKIM DMARC checker workflow, providing the essential data required to verify DMARC alignment and ensure that your entire email authentication chain operates flawlessly.
Components of a DMARC record
A DMARC record is a structured string built from defined tags. Each tag controls a specific aspect of how authentication and reporting behave for the domain.
v= (version): This mandatory tag must appear first with the value DMARC1. Mail servers ignore entries missing this tag or placing it out of order.
p= (policy): This defines the action for emails failing SPF and DKIM checks. Options include none (delivers normally), quarantine (routes to spam), or reject (blocks delivery).
adkim= (DKIM alignment): This dictates how the DKIM signing domain matches the From header. Strict mode (s) requires an exact match, while relaxed mode (r) allows subdomains.
aspf= (SPF alignment): This applies alignment rules to SPF. Strict mode requires the Return-Path to match the From header exactly, while the default relaxed mode accommodates subdomains.
rua= (aggregate reports): This designates the destination address for periodic reports summarizing authentication results across all domain mail flows.
ruf= (forensic reports): This specifies the delivery address for individual message failure reports containing detailed header information.
pct= (percentage): This determines the percentage of non-compliant messages subjected to the policy. Values under 100 support phased rollouts, while 100 serves as the default.
sp= (subdomain policy): This establishes an independent policy for subdomains. Without it, subdomains inherit the root policy. Explicit configuration secures parked subdomains or distinct mail flows.
Why should you perform a DMARC check?
Publishing a DMARC record isn’t a one-time task. DNS configurations change, mail infrastructure is updated, and sending services are added or replaced over time. A DMARC lookup confirms that the record in place at any given point reflects the intended configuration, not a stale or inadvertently modified version.
Several conditions make regular checks necessary. DNS provider migrations can cause records to be dropped or incorrectly transferred. Adding a new email sending service without updating SPF or DKIM records creates alignment failures under an existing DMARC policy. An incorrect tag value, such as a missing rua address or a p=none policy left over from initial setup, reduces the record’s functional value without triggering any visible error.
Running a DMARC check domain audit across all owned domains, including those not used for email, identifies exposure before it results in spoofing or deliverability failures. For bulk senders, Google and Yahoo both require a valid DMARC record as a baseline condition. Confirming that requirement is met before a sending campaign is standard practice, and a DMARC check online returns that confirmation in seconds.
Why should you choose Zoho’s DMARC checker tool?
The Zoho Toolkit DMARC checker performs a live DNS query and returns results in a parsed, tag-by-tag format that doesn’t require DNS expertise to read. No login or account setup is needed, and the tool is accessible directly from any browser, making it practical for teams across varying technical backgrounds.
Each tag is returned with its configured value, so it’s straightforward to verify DMARC policy, alignment settings, and reporting addresses in a single view. Unlike reading raw DNS query output, the parsed format makes misconfigurations immediately visible without additional interpretation.
The Zoho Toolkit also includes SPF and DKIM lookup tools on the same platform. Running a combined review within one workflow reduces the risk of overlooking misalignments between all three records. For organizations managing domain portfolios, the domain DMARC checker can be run across multiple domains without restrictions, and no software installation is required to run a DMARC test online.
How do you use our DMARC checker tool?
To check a DMARC record using the Zoho Toolkit, no setup is required.
Enter the domain name in the input field above.
Click the lookup button to submit the query.
Review the parsed record output displayed below the tool.
The tool queries the _dmarc subdomain of the entered domain and retrieves the TXT record published there. If no record is found, the result clearly indicates that no DMARC entry exists for the domain. The DMARC check online can be run for any publicly registered domain with no restrictions on the number of lookups.
What information appears in DMARC checker results?
The DMARC checker returns the following for each queried domain:
The full raw DMARC TXT record string as published in DNS.
Parsed values for each tag including v, p, adkim, aspf, rua, ruf, pct, and sp.
The TTL value showing how long resolvers cache the record before refreshing.
A validation status confirming whether the record is syntactically correct.
A clear indication when no DMARC record is found at the _dmarc subdomain.
Results are presented in plain language rather than raw DNS format. The policy level, alignment mode, and reporting configuration are all readable without additional interpretation, making the output useful for both technical administrators and non-technical stakeholders reviewing domain authentication posture.
Here’s an example of what a returned record looks like:
Host: _dmarc.example.com
Type: TXT
Content: v=DMARC1; p=quarantine; adkim=s; aspf=r; rua=mailto:reports@example.com
TTL: 3600
Practical applications of a DMARC checker
A DMARC checker serves different functions depending on the role and intent of the person running it.
Email administration: Confirm correct DNS publication and policy intent. A DMARC test online ensures that new configurations are properly formed before impacting delivery.
Security audits: Evaluate domain portfolios and vendor compliance. A DMARC check email verifies that outgoing messages pass end-to-end authentication.
Compliance and deliverability: Ensure that sending addresses meet strict inbox provider requirements before launching large campaigns.
Client infrastructure audits: Consultants use a DMARC check domain step to identify vulnerabilities causing deliverability failures or spoofing risks.
Non-sending domain protection: Secure parked domains by confirming that strict rejection policies are actively published to block unauthorized use.
Frequently Asked Questions
How do I check a DMARC record for my domain?
Enter your domain name into the DMARC checker, one of the free tools in Zoho Toolkit, and run the lookup to test whether a record is published. The tool queries the TXT record at the _dmarc subdomain and returns the DMARC record, its host name, the policy in effect, and the TTL value. No login is needed. To see the same record in the context of your full DNS zone, use the DNS lookup tool.
How do I know if my domain has a valid DMARC record?
Run the check and read the result. A valid record starts with v=DMARC1, includes a policy tag such as p=none, p=quarantine, or p=reject, and uses correct syntax with a single record at _dmarc. If the lookup returns nothing, shows more than one DMARC entry, or contains a malformed tag, the record is missing or invalid and should be corrected on your DNS host.
What is the correct format for a DMARC record?
A DMARC record is a DNS TXT record published at _dmarc.yourdomain.com. It begins with the version tag, followed by a policy tag, and then any optional tags, each separated by a semicolon. A basic record looks like this:
v=DMARC1; p=reject; rua=mailto:reports@yourdomain.com; adkim=s; aspf=s; pct=100
The v tag must appear first and the p tag is required. Common optional tags include rua for the aggregate report address, ruf for forensic reports, sp for subdomain policy, adkim and aspf for alignment mode, and pct for the share of mail the policy applies to. Publish only one DMARC record per domain. If you use Zoho Mail, it generates the DMARC record for your domain as part of the setup process.
What does DMARC compliant mean?
An email is DMARC compliant when it passes DMARC evaluation at the receiving server. This requires the message to pass SPF or DKIM, and for the authenticated domain to align with the domain shown in the From address. A message that fails both checks, or passes but does not align, is not compliant and is handled according to the domain's policy. At the domain level, being DMARC compliant means a valid record is published and enforced.
What is the difference between DMARC and DKIM?
DKIM is an authentication method. It attaches a cryptographic signature to each message so the receiving server can confirm the message came from the domain and was not altered in transit. DMARC is a policy and reporting layer built on top of SPF and DKIM. It tells receiving servers what to do when a message fails authentication, requires the authenticated domain to align with the From address, and sends reports back to the domain owner. Put simply, DKIM verifies a message while DMARC decides the outcome and provides visibility.
What happens if there is no DMARC record for a domain?
Without a DMARC record, receiving servers have no instruction for handling messages that fail authentication, so each server applies its own judgment. The domain has no DMARC-level protection against spoofing of its From address, and the owner receives no reports showing who is sending mail using the domain. Legitimate email can still be delivered when SPF and DKIM are configured, but the domain is more exposed to impersonation and phishing.
How often should I check my DMARC record?
Check your record whenever you change your email setup, add or remove a sending service, or edit your DNS. Outside of those events, a review every few months confirms the record is still present and correct. For continuous oversight, rely on your DMARC reports, which you can read with the DMARC Report Analyzer to track how your policy performs over time.
Will the DMARC checker show me if someone is spoofing my domain?
No. The DMARC checker confirms whether a record is published and shows its contents and policy. It does not monitor live email traffic or detect spoofing as it happens. To see which servers are sending mail using your domain, including unauthorized ones, review your DMARC aggregate reports. These arrive as XML files at the address set in your rua tag, and the DMARC Report Analyzer presents them in a readable format so you can identify suspicious activity. To investigate a suspicious sending domain further, the WHOIS lookup shows its registration and ownership details.
What does a valid DMARC record look like?
A valid record is a single TXT entry at _dmarc.yourdomain.com that begins with v=DMARC1 and includes a valid policy. For example:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100
In this record, v=DMARC1 identifies the record type, p=quarantine directs receiving servers to send failing mail to spam, rua sets the address for aggregate reports, and pct=100 applies the policy to all mail. A record using p=none monitors without taking action, while p=reject blocks failing mail outright.
How does DMARC affect my email deliverability?
Set up correctly, with SPF and DKIM aligned, DMARC signals to receiving servers that your mail is legitimate, which supports steady inbox placement and protects your domain from being used in spoofing attacks. A misconfigured record does the reverse. Moving to an enforcement policy of quarantine or reject before all your sending sources are authenticated can cause legitimate mail to be filtered or blocked. The safer path is a phased rollout: start at p=none to collect report data, then tighten the policy as each source is confirmed.