DMARC Checker
Enter any domain to check its DMARC record. We validate your policy, inspect alignment settings, check reporting destinations, and flag anything that could leave your domain unprotected.
Understanding Your DMARC Check
Here's what each result means and what to do next.
DMARC Pass
Your DMARC policy is properly configured and enforcing
A passing result means your DMARC record exists, your policy is actively protecting your domain, and your reporting is configured so you have visibility into authentication results. Make sure your SPF and DKIM records are also properly set up, DMARC depends on both.
- Valid DMARC record found
- Policy is set to quarantine or reject
- Aggregate reporting is configured
- SPF and DKIM alignment is set
DMARC Warning
Your record works but has issues worth fixing
A warning means your DMARC record exists and is syntactically valid, but it's not fully protecting your domain. The most common warning is p=none — which monitors authentication but doesn't take action on failures. This is a good starting point, but you need to progress to quarantine and then reject to actually stop spoofing.
- Policy is set to none (monitoring only)
- Missing aggregate or forensic reporting
- Subdomain policy not explicitly set
- Percentage tag is below 100%
DMARC Fail
Your DMARC configuration has issues that need to be fixed
A failing result means your domain has no DMARC protection — anyone can send email that appears to come from your domain, and receiving servers have no policy to enforce. The most common causes are a missing record, syntax errors, or duplicate DMARC TXT records. Each of these is fixable — review the details above for specific guidance.
- No DMARC record found
- Syntax errors in the DMARC record
- Multiple DMARC records on the same domain
- Invalid policy or tag values
Common DMARC Problems and How to Fix Them
These are the DMARC problems we see most often. If your check flagged any of these, here's what they mean and how to fix them.
Policy Stuck on None
The most common DMARC gap
The majority of domains with DMARC still have their policy set to p=none — which means they're collecting data but not actually protecting against spoofing. None is the right place to start, but staying there indefinitely gives you no more protection than having no DMARC at all. The path to enforcement requires reviewing aggregate reports, aligning all legitimate senders, then progressively tightening the policy.
Missing Report Destinations
Flying blind on authentication
DMARC reporting is what makes the protocol actionable. Without aggregate reports (rua), you can't see which services are sending email as your domain or whether they're passing authentication. Without that data, you can't safely progress your policy — because you don't know what you'd break. Adding rua is the single most impactful first step.
SPF or DKIM Alignment Failures
Passing auth but failing DMARC
DMARC doesn't just check whether SPF or DKIM pass — it checks whether the authenticated domain aligns with the From header domain. A message can pass SPF and DKIM but still fail DMARC if the domains don't match. This is especially common with third-party senders like marketing platforms and CRMs that use their own domains for the envelope sender or DKIM signature.
No DMARC Record Found
No protection at all
If no DMARC record exists for your domain, receiving servers have no way to know what you want them to do when SPF or DKIM fails. That means anyone can forge emails from your domain and there's no policy stopping them. Publishing even a basic p=none record with aggregate reporting is a significant improvement — it gives you visibility and signals to receivers that you're working on authentication.
Why DMARC Matters for Your Business
Your Domain Gets Used in Phishing Attacks
Legitimate Emails Land in Spam
You Have No Visibility Into Your Email
Compliance and Insurance Requirements
Check Your Full Email Authentication with iO™ DMARC
SPF is one piece of the puzzle. Use these tools to check the rest of your email authentication stack.
SPF Checker
Validate your SPF record and confirm which servers are authorized to send on your behalf. DMARC relies on SPF alignment to verify the envelope sender.
DKIM Checker
Verify your DKIM signature to make sure outgoing emails are cryptographically signed. DMARC uses DKIM alignment to verify message integrity.
BIMI Checker
See if your domain qualifies to display your brand logo in supported inboxes. BIMI requires a DMARC policy of quarantine or reject to be eligible.
MTA-STS Checker
Check whether your domain enforces encrypted email delivery. MTA-STS protects the transport layer, while DMARC protects the authentication layer.
TLS-RPT Checker
Verify your TLS reporting setup. Just like DMARC gives you authentication reports, TLS-RPT gives you visibility into encrypted delivery failures.
Email Authentication Audit
Get a complete picture of your SPF, DKIM, DMARC, BIMI, and MTA-STS configuration in one report. See what’s working, what’s broken, and what to fix first.
Ready to secure your email domain?
SPF is just the first layer. iO™ DMARC manages your entire email authentication stack, so you don't have to.
Learn About DMARC
How to Set Up DMARC
DMARC Failure Troubleshooting
How to Read DMARC Reports
Ready to Fix Your Email Authentication?
Found issues with your DMARC record? Or just want someone to handle email authentication so you don't have to think about it? Let's talk.
Done Wrestling with Raw DMARC Reports?
iO™ DMARC turns aggregate and forensic XML into plain-language dashboards, discovers every sender on your domain, and guides your policy from p=none to p=reject without breaking legitimate email.
Meet iO™ DMARC