CertaDNS

Free Tool · DMARC

DMARC Inspector

Read a domain's DMARC record, explain every tag, and check the two things that quietly stop DMARC working: alignment mode and external report authorisation.

Free · no signup · reads public DNS only ·

What the DMARC Inspector checks

DMARC is a TXT record at _dmarc.yourdomain.com. It ties SPF and DKIM to the address a human actually sees, tells receivers what to do when that check fails, and asks them to send you reports. Without it, SPF and DKIM mostly generate information nobody acts on.

Policy, and why p=none is not protection

p=none asks receivers to do nothing. It is the right place to start and the wrong place to stop — a domain sitting at p=none is exactly as spoofable as one with no DMARC at all, it just generates reports about it. p=quarantine sends failures to spam; p=reject blocks them. Only the last two stop anything.

Alignment, the part that surprises people

A message can pass SPF, pass DKIM, and still fail DMARC. DMARC only counts a pass if the domain that passed aligns with the one in the From header. adkim and aspf control how strictly. Under relaxed alignment (the default), mail.example.com passing counts for example.com. Under strict, it does not — which is a common cause of failures that look inexplicable from the reports alone.

External report authorisation

If your rua points at a mailbox on a different domain — a reporting vendor, or your own second domain — then that domain has to publish a record authorising it, per RFC 7489 §7.1: yourdomain.com._report._dmarc.theirdomain.com. Without it, conforming receivers silently drop the reports. The symptom is DMARC that looks perfectly configured and produces nothing at all, which is genuinely hard to diagnose from the outside — so this inspector checks it for every destination.

Frequently asked questions

What does p=none actually do?+

Nothing, to the mail. It asks receivers to deliver as normal and send you aggregate reports. That is the correct first step, because it is how you discover your own senders before you start blocking things — but a domain left there is not protected.

Why would mail fail DMARC when SPF and DKIM both pass?+

Alignment. DMARC only counts a pass if the passing domain matches the From header domain — exactly, under strict alignment, or on the organisational domain under relaxed. A service sending as you from its own envelope domain passes SPF for itself and fails alignment for you.

I set up rua and receive nothing. Why?+

The usual cause is RFC 7489 §7.1: if the mailbox is on another domain, that domain must publish an authorisation record naming yours. Without it, receivers drop the reports silently. This tool checks each destination for exactly that.

Should I use sp=?+

Only if you want subdomains treated differently. Leave it out and subdomains inherit your p= value, which is usually what you want. sp=none under an enforcing p= is the dangerous combination — attackers prefer subdomains because they look more plausible than a look-alike domain.

What about pct?+

It applies the policy to a sample of your mail. Useful as a ramp while rolling out enforcement, and a liability if it is left behind: pct=10 at p=reject means nine out of ten spoofed messages still get delivered.

Check something else

  • SPF Inspector

    Will my SPF record pass, or has it quietly gone over the lookup limit?

  • DKIM Inspector

    Is my DKIM key actually published, and is it strong enough?

  • DNSSEC Analyzer

    Is my zone signed, is the chain actually complete, and are the signatures fresh?

Understand it, then fix it