DMARC Checker

DMARC Checker: Test DMARC, SPF and DKIM Records

Type a domain. The tool reads its DMARC, SPF and DKIM records over DNS, explains each tag, counts SPF lookups and tells you what to fix before Gmail or Yahoo start refusing your mail.

Runs in your browser. Only the domain name goes out, to a public DNS resolver.

A bare domain, a mail address or a full link: the tool picks the domain out of it.
Leave it empty to try the 6 most common names, then the rest of 41 if you ask.

One check is 3 to 50 DNS lookups, sent from your browser to a public resolver. The domain is not stored.

Sample report for example.com. Check your own domain to replace it.

Sample report

example.com

2 pass1 warning0 fail12 DNS lookups, 6 of 41 selectors tried via Cloudflare

warn

DMARC

p=none, reports go to [email protected]

Record, tags and fix 
_dmarc.example.com  TXT
v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r
v
DMARC1
Version, has to come first
p
none
Policy: deliver as usual, only send reports
rua
mailto:[email protected]
Daily aggregate reports go here
sp
not set
Subdomain policy: follows p, so subdomains are also none
pct
100
Share of mail the policy applies to, default
adkim, aspf
r
Relaxed alignment: subdomains of the From domain pass

Fix: once a few weeks of reports show every sender passing, move to p=quarantine with pct=10 and name a subdomain policy.

v=DMARC1; p=quarantine; pct=10; sp=quarantine; rua=mailto:[email protected]
pass

SPF

7 of 10 lookups, ends with ~all

Record and include tree 
example.com  TXT
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ip4:203.0.113.0/24 ~all

DNS lookups7 of 10

  • example.com1 record, 95 of 450 octets
    • include:_spf.google.com4
      • include:_netblocks.google.com1ip4 ranges
      • include:_netblocks2.google.com1ip6 ranges
      • include:_netblocks3.google.com1ip4 ranges
    • include:sendgrid.net1ip4 ranges
    • include:mailgun.org2
      • include:_spf.mailgun.org1ip4 ranges
    • ip4:203.0.113.0/240own range, no lookup
    • ~allsoftfail for everyone else

Each include, a, mx, ptr, exists and redirect costs one lookup; a branch shows its total. Void lookups 0 of 2. Three lookups left before receivers return permerror.

pass

DKIM

selector google, 2048-bit RSA key

Record and tags 
google._domainkey.example.com  TXT
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4Zt1…
v
DKIM1
Version
k
rsa
Key type
p
2048-bit key
Gmail accepts from 1024 bits and advises 2048
t
not set
Not in test mode, signatures count

Found on name 1 of 41. Know another selector? Type it on the left.

Ready for Gmail and Yahoo

  • SPF or DKIM publishedboth
  • DMARC with p=none or stricterp=none
  • From domain can alignSPF on example.com, DKIM key on example.com

Checks the records you publish, not real messages. Whether mail actually passes shows up in DMARC reports.

How it works

  1. Enter the domainType the domain you send mail from, such as example.com. A DKIM selector is optional: leave it empty and the tool tries the selector names that common mail providers use.
  2. Read the three verdictsDMARC, SPF and DKIM each get a pass, a warning or a fail, with the raw record underneath. Every tag is explained in plain words, and the SPF tree shows which includes use up your 10 lookups.
  3. Fix what is flaggedEach warning comes with the change to make, from moving p=none to quarantine to dropping an SPF include you no longer use. Copy the suggested record and paste it into your DNS.

What the SPF record check looks at

SPF fails in quiet ways. A domain can have two records, which makes receivers ignore both. An include chain can pass the limit of 10 DNS lookups set by RFC 7208, which turns the whole record into a permanent error. The check follows every include and redirect, counts the lookups, flags +all, ptr and a missing all mechanism, and draws the chain as a tree so you can see which service costs the most.

DKIM selectors and what the tool can and cannot find

A DKIM key lives at selector._domainkey.yourdomain, and the selector name is not published anywhere. If you know it, type it. If not, the tool tries the 6 names mail providers use most, such as google, selector1 and selector2, and on request the rest of a list of 41, such as k1 and s1. A miss means none of those names answered, not that the domain has no DKIM. The sure way is to open a message you sent and read the s= tag in its DKIM-Signature header.

Questions

Does the lookup send my domain anywhere?

The page asks a public DNS resolver (Cloudflare 1.1.1.1, with Google Public DNS as a fallback) for the records, the same way a mail server would. The only thing that leaves your browser is the domain name and the selector names being tried. There is no account, nothing is stored on a server of ours, and results are not kept.

Why do Gmail and Yahoo care about DMARC?

Since February 2024 both require senders of more than 5,000 messages a day to publish a DMARC record, with at least p=none, and to have the From domain line up with SPF or DKIM. Smaller senders still need SPF or DKIM. A missing or broken record is one of the usual reasons mail lands in spam or bounces.

Can it tell me whether my mail passes DMARC?

No. DMARC passes or fails per message, based on what the receiver sees. This tool checks the records you publish, which is the half you control. Whether real mail aligns and passes shows up only in DMARC aggregate reports, which need a mailbox or a monitoring service to read them.

More detail in the guide: DMARC Record Generator: Build a Correct TXT Record.