Free Tool · DMARC
DMARC Inspector
Read a domain's DMARC record, explain every tag, and check the two things that quietly stop DMARC working: alignment mode and external report authorisation.
Free · no signup · reads public DNS only ·
What the DMARC Inspector checks
DMARC is a TXT record at _dmarc.yourdomain.com. It ties SPF and DKIM to the address a human actually sees, tells receivers what to do when that check fails, and asks them to send you reports. Without it, SPF and DKIM mostly generate information nobody acts on.
Policy, and why p=none is not protection
p=none asks receivers to do nothing. It is the right place to start and the wrong place to stop — a domain sitting at p=none is exactly as spoofable as one with no DMARC at all, it just generates reports about it. p=quarantine sends failures to spam; p=reject blocks them. Only the last two stop anything.
Alignment, the part that surprises people
A message can pass SPF, pass DKIM, and still fail DMARC. DMARC only counts a pass if the domain that passed aligns with the one in the From header. adkim and aspf control how strictly. Under relaxed alignment (the default), mail.example.com passing counts for example.com. Under strict, it does not — which is a common cause of failures that look inexplicable from the reports alone.
External report authorisation
If your rua points at a mailbox on a different domain — a reporting vendor, or your own second domain — then that domain has to publish a record authorising it, per RFC 7489 §7.1: yourdomain.com._report._dmarc.theirdomain.com. Without it, conforming receivers silently drop the reports. The symptom is DMARC that looks perfectly configured and produces nothing at all, which is genuinely hard to diagnose from the outside — so this inspector checks it for every destination.
Frequently asked questions
What does p=none actually do?+
Nothing, to the mail. It asks receivers to deliver as normal and send you aggregate reports. That is the correct first step, because it is how you discover your own senders before you start blocking things — but a domain left there is not protected.
Why would mail fail DMARC when SPF and DKIM both pass?+
Alignment. DMARC only counts a pass if the passing domain matches the From header domain — exactly, under strict alignment, or on the organisational domain under relaxed. A service sending as you from its own envelope domain passes SPF for itself and fails alignment for you.
I set up rua and receive nothing. Why?+
The usual cause is RFC 7489 §7.1: if the mailbox is on another domain, that domain must publish an authorisation record naming yours. Without it, receivers drop the reports silently. This tool checks each destination for exactly that.
Should I use sp=?+
Only if you want subdomains treated differently. Leave it out and subdomains inherit your p= value, which is usually what you want. sp=none under an enforcing p= is the dangerous combination — attackers prefer subdomains because they look more plausible than a look-alike domain.
What about pct?+
It applies the policy to a sample of your mail. Useful as a ramp while rolling out enforcement, and a liability if it is left behind: pct=10 at p=reject means nine out of ten spoofed messages still get delivered.
Check something else
- SPF Inspector
Will my SPF record pass, or has it quietly gone over the lookup limit?
- DKIM Inspector
Is my DKIM key actually published, and is it strong enough?
- DNSSEC Analyzer
Is my zone signed, is the chain actually complete, and are the signatures fresh?
Understand it, then fix it
- DMARC alignment
How the protocol behaves, and why.
- Getting to p=reject safely
How the protocol behaves, and why.
- Why your reports never arrive
How the protocol behaves, and why.
- DMARC Reporting
Step by step, in the CertaDNS dashboard.
- Email Authentication
What we automate, and what it costs.
- All free tools
Every check we publish, in one place.