DMARC checker
Enter a domain and see its DMARC record, what its policy does, and what to change. One DNS lookup, nothing sent to the site.
What the result shows
- Whether a DMARC record exists at _dmarc
- The policy: none, quarantine or reject
- What share of mail it applies to, and where reports go
Read-only: the same lookups a browser or a mail server makes, nothing changed, nothing stored beyond ten minutes. What Stackbrace asks for.
What is a DMARC record?
A TXT record at _dmarc.yourdomain that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM: deliver it anyway (p=none), put it in spam (p=quarantine) or refuse it (p=reject). It also names an address that receives reports of who is sending as your domain.
Why does p=none matter?
p=none only asks for reports. Faked email in your domain's name is still delivered. It is the right place to start, so the reports can show you every legitimate sender before you tighten the policy, but it is not the place to stay.
What should a finished DMARC record look like?
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain, with SPF and DKIM set up for every service that sends in your name. Move from none to quarantine to reject as the reports show your own senders passing.
Every day, not just today
Stackbrace checks every site's DMARC, SPF and DKIM every day and tells you when a record goes missing or changes. Start free with one site.