Free tool · no signup
Check any domain's DMARC record
Checks DMARC, SPF and DKIM together, explains every tag, and hands you a corrected record to paste — with guidance specific to Microsoft 365, Google Workspace, or whoever handles your mail.
Checks DMARC, SPF and DKIM together. Nothing is stored.
What gets checked
More than “is the syntax valid”.
DMARC policy and every tag
Whether p is none, quarantine, or reject — and whether pct quietly exempts most of your mail from it. v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf and ri are each parsed, checked against the spec, and translated out of RFC language.
SPF, including the lookup limit
SPF allows ten DNS lookups counted through every include, and past that it fails for your whole domain at once. This follows the include chain and counts them properly, then flags +all and a missing all.
DKIM, by provider selector
DKIM selectors cannot be enumerated — but once MX identifies the provider, the selector is predictable: selector1/selector2 on Microsoft 365, google on Workspace. Common defaults are checked too.
A corrected record to paste
Every result ends in a generated DMARC record built from what you already publish — repaired, reordered, with reporting filled in. It never raises your enforcement level on its own.
Reporting that actually arrives
Sending reports outside your own domain requires the receiving domain to opt in. If that authorisation is missing, your reports are silently dropped — you appear to have monitoring and receive nothing.
Your mail provider's specific traps
An MX lookup identifies who handles your mail, then the result calls out the mistakes that provider in particular invites — the ones a generic syntax check will pass.
Microsoft 365
The three M365 traps.
Most DMARC failures on Microsoft 365 come down to the same three things, and none of them are visible in the admin center. First, the DMARC record does not live in Microsoft 365 at all — it is a TXT record at _dmarc wherever your domain's DNS is hosted, and M365 will show the domain as healthy regardless. Second, DKIM signing for your custom domain is off by default, so Microsoft signs outbound mail as yourtenant.onmicrosoft.com — a valid signature for the wrong domain, which fails alignment and quietly leaves SPF carrying your whole policy. Third, Microsoft does not send you your own aggregate reports; those arrive from receivers to whatever address you put in rua=.
Check your domain above and the result will tell you which of these apply to you, or read the full Microsoft 365 DMARC guide for the portal steps.
Why it matters
No DMARC is an open door.
Without a DMARC policy, anyone can put your domain in the From address of an email and receivers have no instruction to stop them — which is how invoice fraud and payroll-redirect scams reach people who trust your brand. Google and Yahoo now require DMARC for bulk senders outright, so it has also stopped being optional for anyone doing marketing volume. The policy that closes the door is p=reject, but you get there by starting at p=none and reading the reports first — enforcing before you know which of your own senders fail is how companies block their own invoices.
Questions
Fair questions, straight answers.
What is a DMARC record?
A DMARC record is a TXT record published in DNS at _dmarc.yourdomain.com. It tells receiving mail servers two things: what to do with mail that claims to be from your domain but fails authentication (the policy), and where to send reports about it. Without one, anyone can put your domain in the From address and receivers have no instruction to stop them.
How do I check my DMARC record?
Type your domain into the box above. This tool queries the live DNS TXT record at _dmarc.yourdomain.com, parses every tag, and explains what each one does and what is missing. It also looks up your MX records to work out who handles your mail, and gives guidance specific to that provider.
My domain has no DMARC record. Is that bad?
It means your domain has no spoofing protection and you have no visibility into who is sending mail as you. Start with v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com — this changes nothing about how mail is delivered, it just turns on reporting. Read a week of those reports before you move to quarantine or reject.
How do I create a DMARC record?
Check your domain above and the result ends with a generated record you can copy straight into DNS. It is built from whatever you already publish — repaired, reordered, with a reporting address filled in — rather than a blank template. If nothing is published yet you get v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100, which is the correct starting point: it turns on reporting and changes nothing about delivery. Publish it as a TXT record named _dmarc on your domain.
Does this check SPF and DKIM too?
Yes — all three in one lookup. SPF is checked for the ten-DNS-lookup limit (counted recursively through every include, which is how receivers count it), for a missing or overly permissive all mechanism, and for duplicate records. DKIM is harder because selectors cannot be enumerated, so the tool uses the provider detected from your MX records: selector1 and selector2 for Microsoft 365, google for Google Workspace, plus common defaults like default and k1. A key found under a selector unique to your sender will not be detected, and the result says so rather than claiming DKIM is missing.
Why does the checker care which provider I use?
Because the failure modes are provider-specific. Microsoft 365 signs mail as yourtenant.onmicrosoft.com until you explicitly enable DKIM for your custom domain, which breaks alignment in a way no generic checker will tell you about. Google Workspace generates a DKIM key but leaves it switched off. Amazon SES needs a custom MAIL FROM domain for SPF to align at all. A record that looks perfect can still fail for any of these reasons.
What does p=none actually do?
Nothing, to your mail — and that is the point. p=none is monitoring mode: receivers evaluate DMARC, send you reports, and deliver the mail exactly as they would have anyway. It is the correct first step because it is risk-free, and the wrong place to stop, because it protects nothing. The policy that stops spoofing is p=reject.
Is it free? Do you store the domains I check?
Free, no signup, no email gate. Lookups run against public DNS and are held in memory for a few minutes so repeat checks are fast — nothing is written to a database and nothing is associated with you.
Send mail that passes.
Volanea sets up SPF, DKIM, and DMARC alignment for your sending domain as part of onboarding — then sends transactional email, campaigns, and automation on 1,000 free credits a month.