DMARC Checker
Is your DMARC actually enforcing?
A free DMARC checker for UK businesses. Paste your domain — we fetch your DMARC record, grade the policy strength, check subdomain coverage and reporting, and tell you in plain English whether a spoofer could still send mail in your name. SPF and DKIM checked in the same pass, because DMARC is only as strong as what it sits on.
Check your record
What we grade
Four parts
of the record
A DMARC record is one TXT entry at _dmarc.yourdomain.co.uk, but the details decide whether it protects you or merely exists. The checker reads each tag and grades what it finds.
- № 01
Policy — p=
The enforcement level.
p=nonemeans "monitor only" — receivers report failures but deliver the spoof anyway.p=quarantinesends failures to spam;p=rejectbounces them outright. Most UK SMEs that have DMARC at all sit atp=noneyears after setting it up — protected on paper, spoofable in practice. - № 02
Subdomain policy — sp=
Without it, subdomains inherit your main policy — which is fine until someone relaxes the main record and forgets that
invoices.yourdomain.co.ukrides along. Spoofers deliberately target subdomains because recipients trust anything ending in your domain. We flag records where subdomain coverage is weaker than the organisational policy. - № 03
Coverage — pct=
pct=100(or omitted) applies your policy to all mail. Lower values were meant as a rollout aid — apply reject to 25% of traffic, watch the reports, ratchet up — but records get stuck atpct=25indefinitely, leaving three-quarters of spoofed mail delivered. The checker calls that out. - № 04
Reporting — rua=
The aggregate-report address receivers send daily XML summaries to: who sent as you, from where, and whether it passed. Without
rua=you're flying blind — you can't safely move fromp=nonetop=rejectbecause you can't see which legitimate senders would break.
FAQ
Common
questions
- Q1
What is a DMARC record?
A TXT record published at _dmarc.yourdomain that tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM checks: deliver it anyway, quarantine it to spam, or reject it. It's the enforcement layer of email authentication — SPF and DKIM verify, DMARC decides.
- Q2
Is p=none good enough?
No — p=none only monitors. Spoofed mail is still delivered; you just get a report about it. It's the right place to start while you gather reports and confirm your legitimate senders pass, but the destination is p=quarantine and then p=reject. Procurement questionnaires increasingly ask for p=quarantine or stricter.
- Q3
Does DMARC need both SPF and DKIM?
A message passes DMARC if it passes either SPF or DKIM with alignment — but you should publish both. Forwarded mail routinely breaks SPF, so DKIM is what keeps legitimate forwarded messages deliverable once you enforce. Running DMARC on SPF alone is how newsletters end up in spam the day you switch to p=reject.
- Q4
What does a good DMARC record look like?
For a typical UK SME: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.co.uk; — a real policy, full coverage, and reporting switched on. Publish it as a TXT record named _dmarc at your DNS provider, watch the reports for a few weeks, then tighten to p=reject.
The other two records