Email

DMARC Checker

Check DMARC policy and alignment configuration.

Enter a bare domain name, such as example.com. The check reads the _dmarc record from public DNS via the FKINFAST server — not from your browser — and the result is not stored.

Results appear here. Enter a domain name, then select Check DMARC.

Domain Health Report

This page checks one thing. The report checks thirteen — and tells you what to fix first.

A one-off €14.90 report, delivered by email in minutes. Every finding comes with a concrete fix, prioritized.

  • DNS records (A/AAAA)
  • Nameservers (NS)
  • Mail servers (MX)
  • SPF record and policy
  • DMARC record and policy
  • DKIM record (common selectors)
  • HTTPS availability
  • HTTP to HTTPS redirect
  • TLS certificate (issuer, validity, expiry)
  • Security headers (HSTS, CSP…)
  • CAA records
  • robots.txt availability
  • sitemap.xml availability
Get the Domain Report€14.90 · One-time payment. No subscription.

How the DMARC check works

  1. Enter a bare domain name, such as example.com, and submit the form.
  2. The FKINFAST server queries the _dmarc TXT record of the domain through a public resolver and reads the declared policy.
  3. The result shows the record and a PASS, WARNING, FAIL or UNKNOWN classification, with a plain explanation of what the policy enforces.

The check runs from FKINFAST's server, not from your browser. The domain you enter is not stored and the result is not linked to you.

Result states

PASS
The DMARC record declares p=quarantine or p=reject, so spoofed mail is actively policed.
WARNING
The record exists but only monitors (p=none), or it declares no usable policy.
FAIL
No DMARC record was found, so anyone can spoof this domain without any policy.
UNKNOWN
The lookup could not be completed: it timed out or the public resolver failed.

Page-level errors are separate from these results. A validation error, rate limit, busy response, unavailable service or network failure is shown as an error, not as a FAIL result.

How the record is evaluated

  • The check reads the _dmarc TXT record and looks for a usable p= (policy) tag.
  • p=reject is the strongest policy; p=quarantine sends suspicious mail to spam instead.
  • p=none collects reports only and blocks nothing — useful during rollout, not as a destination.
  • A record without a recognizable policy tag is reported as unusable.
  • Detailed report options (rua, ruf, alignment settings) are shown as part of the record but are not separately evaluated.
  • Limited to 15 checks per 60 seconds per client IP (shared with the SPF checker).

What the check does not do

The check evaluates the published DMARC record only. It does not test SPF or DKIM alignment, does not send probe emails, does not read DMARC aggregate reports and does not verify that your mail actually passes DMARC.

DMARC checker FAQ

Is p=none useful at all?

Yes — as a first step. With p=none you receive reports that show who is sending as your domain, without risking lost mail. Once the reports look clean, move to quarantine then reject.

Should I use p=quarantine or p=reject?

quarantine asks receivers to treat failing mail as suspicious (usually spam); reject asks them to refuse it outright. reject is the goal for a domain that only sends legitimate mail.

Does DMARC work without SPF and DKIM?

DMARC passes when either SPF or DKIM aligns with the domain. Without both properly configured, strict policies will reject legitimate mail — verify SPF first, then DKIM, then tighten DMARC.

I just added the record — why is it not found yet?

DNS changes take time to spread, and the check may briefly serve a cached answer. The record name must be exactly _dmarc.yourdomain.com. If your provider shows it, wait a few minutes and retry.

Related tools