DMARC Lookup
Look up and analyze a domain's DMARC policy and reporting configuration.
What is DMARC Lookup?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receiving mail servers what to do when an incoming message fails SPF or DKIM authentication for your domain. Published at _dmarc.<domain>, it specifies a policy of none (monitor only), quarantine (treat as spam), or reject (refuse the message), along with a percentage of mail to enforce it on and addresses for aggregate and forensic reports. It also enforces alignment, requiring the domain that passed SPF or DKIM to match the visible From address. Without DMARC, SPF and DKIM results are advisory only, so spoofed mail claiming to be from your domain is not actively refused even when it fails those underlying checks.
How to Use DMARC Lookup
- Type a domain name (e.g. yourcompany.com) and click "Look up".
- The tool queries _dmarc.<yourdomain> for a TXT record starting with "v=DMARC1".
- Each tag (policy, subdomain policy, percentage, report addresses) is parsed and explained.
- Common issues — a "none" policy, a reduced enforcement percentage, or a missing report address — are flagged with a plain-language explanation.
Examples
Strong policy
Input: v=DMARC1; p=reject; rua=mailto:reports@example.com
Output: Policy: reject, aggregate reports enabled — no warnings
Monitoring only
Input: v=DMARC1; p=none; rua=mailto:reports@example.com
Output: Warning: policy is "none" — failing mail isn't rejected or quarantined
Common Mistakes
- Jumping straight to p=reject without first reviewing aggregate reports under p=none — this can silently block legitimate mail from services you didn't realize needed SPF/DKIM alignment.
- Setting up DMARC but never configuring an rua address, so misconfigurations and spoofing attempts go unnoticed indefinitely.
- Assuming DMARC alone stops spoofing — it only takes effect if SPF and/or DKIM are also correctly configured and aligned; DMARC with no working SPF or DKIM has nothing to enforce.
Why Use This Tool
- Parses every DMARC tag and explains what each one actually does, not just whether a record exists.
- Flags the specific issues that quietly weaken enforcement (none policy, reduced pct, missing rua) rather than a blanket pass/fail.
- Runs the lookup server-side via DNS-over-HTTPS, consistent regardless of your own network's DNS behavior.
- No sign-up, no rate-limited third-party dashboard — a plain, fast, one-off check.