DMARC Checker

Check a DNS policy, not an email message

Enter the author domain itself, without _dmarc or an email address. The tool queries _dmarc at that name and, if necessary, follows the RFC 9989 DNS tree-walk rules to discover an inherited policy.

DMARC authentication also depends on SPF or DKIM results and identifier alignment for an actual message. This form has none of that message context and never returns a message-level DMARC pass or fail.

_dmarc.example.com. 300 IN TXT "v=DMARC1; p=none"

DOCUMENTATION EXAMPLE — not a live DNS response

Current policy discovery

This implementation targets RFC 9989, published in May 2026, rather than relying exclusively on the superseded RFC 7489 public-suffix-list method. It retains queried owners and selected policy records as evidence.

The tree walk is bounded, respects psd boundary tags and does not guess an organizational domain from the last two labels. Subdomain policy selection distinguishes an existing name from NXDOMAIN. A transient error makes discovery incomplete.

Policy intent and configuration findings

none is monitoring intent, not a syntax failure. quarantine and reject request handling of messages that fail DMARC, but the receiving system’s actual action is not measured here.

Duplicate candidates, duplicate tags and malformed values are reported. Unknown tags are retained and ignored rather than automatically rejected. Legacy pct is not applied as an enforcement percentage under RFC 9989.

If policy fields are invalid but a syntactically valid aggregate-report URI exists, the RFC 9989 monitoring fallback is explained. Finding a record is not a blanket green security certificate.

What remains outside this check

External reporting-destination authorization, report delivery, DKIM keys, message identifier alignment and real receiving-system behavior are not checked. Report URIs are never requested, and no test email is sent.

Use the displayed raw records and discovery path when reviewing a finding. For a production mail change, validate with your mail platform and the current standard, then monitor actual authentication reports.