DMARC Lookup
Retrieve the DMARC record published at _dmarc.<domain>, check its syntax and see whether the policy actually protects the domain against spoofing.
- Runs on our servers
- Free to use
- API available →
About this tool
DMARC is the policy layer on top of SPF and DKIM and the single most effective step against e-mail impersonation of your domain. This tool fetches the record from _dmarc.<domain> with the APIVoid DMARC Validator API and explains it: the domain and subdomain policies, whether the policy is enforced, the reporting addresses, the DMARC version tag and any syntax or configuration issues found.
Use it when deploying DMARC, when reports stop arriving, or when auditing a partner domain. For the SPF side and an overall spoofability verdict, run the Email Spoof Check.
This is what a result looks like (trimmed):
$ dig _dmarc.google.com TXT +short
"v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"How to use it — quick steps
- 01
Enter the domain or hostname
Type or paste the domain or hostname in the field above, for example example.com. Use Ctrl + V to paste.
- 02
Press "Check DMARC"
Press "Check DMARC" or Ctrl + Enter. The result appears below in a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
External lookups
The lookup runs from our infrastructure, so you see what the public internet sees without exposing your own IP address or network.
Fast and cached
Results come back in seconds; identical lookups are cached for a few minutes to keep the service fast and responsive for everyone.
Easy to reuse
Every result block can be copied with one click or downloaded as a text file, and tables can also be saved as CSV for your reports.
Frequently asked questions
What is DMARC?
A DNS policy that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment (nothing, quarantine or reject) and where to send reports about them.
p=none is a valid record, why is it flagged?
p=none only monitors. Spoofed mail is still delivered; the domain is protected only when the policy is quarantine or reject.
What are rua and ruf?
rua is the address that receives daily aggregate XML reports; ruf receives per-message forensic reports (rarely sent by big providers). The tool checks that those mailboxes' domains have MX records.
How do I move to p=reject safely?
Start with p=none and reports, make sure all legitimate senders pass SPF or DKIM with alignment, then switch to quarantine with a low pct, and finally reject.