Free DMARC Lookup

01 · Definition

What is dmarc lookup?

A DMARC lookup reads the Domain-based Message Authentication, Reporting and Conformance record published as a TXT record at _dmarc.yourdomain.com. DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM alignment — none (monitor only), quarantine (divert to junk), or reject (drop the message entirely) — and where to send authentication failure reports.

The tool above queries _dmarc.yourdomain.com, retrieves the raw v=DMARC1 record, and surfaces the enforcement policy, alignment modes for both DKIM and SPF, the percentage of traffic the policy applies to, and any reporting addresses configured. Read the in-depth DMARC lookup guide for record syntax, what each tag means, and the recommended rollout path from p=none to p=reject.

02 · Process

How it works

1. 1Query the _dmarc. subdomain.DNS resolves the TXT records at _dmarc.yourdomain.com — not the apex. The underscore prefix is the RFC 7489 convention; it scopes DMARC queries away from any other TXT records on the domain.
2. 2Find the v=DMARC1 record.The record must begin with v=DMARC1;. If no such record exists, the domain has no DMARC policy and receivers handle authentication failures independently.
3. 3Parse the policy tag.The p= tag is the enforcement action: none reports only, quarantine diverts to junk, reject drops the message entirely. It is the single most important tag in the record.
4. 4Read alignment modes.adkim= and aspf= control whether the authenticated domain must exactly match the From header domain (s = strict) or can be a parent or subdomain (r = relaxed). Relaxed is the safe default for most senders.
5. 5Surface reporting addresses.rua= lists addresses for aggregate reports (daily digests of authentication outcomes); ruf= lists addresses for forensic reports (per-message failures). Both are optional, but rua= is strongly recommended for any active monitoring.

03 · Risk

Why it matters

DMARC is the layer that binds SPF and DKIM authentication to the From header — the address the recipient actually sees. Without DMARC, a sender can pass SPF on a different envelope domain while the visible From header is entirely spoofed. With p=none, you gather reports but do nothing. With p=quarantine or p=reject, you close the door on domain spoofing.

For regulated firms, DMARC is no longer optional. Google and Yahoo mandated at minimum p=none with an rua= address for any domain sending more than 5,000 messages per day from February 2024. Enforcement means mail goes to spam or is rejected. And the enforcement picture for financial-services firms sending unauthenticated mail is getting sharper every year.

04 · Use cases

Common ways to use this tool

• Pre-send authentication audit. Before the first campaign from a new domain, confirm DMARC is published and the policy aligns with your SPF and DKIM setup.
• DMARC rollout verification. Moving from p=none to p=quarantine or p=reject requires confirming the policy change propagated in DNS before tightening enforcement further.
• Partner and vendor due diligence. In financial services, a counterparty with p=none and no reporting address is a signal of weak email security hygiene — relevant when vetting firms that send you trade confirmations or client communications.
• Spoofing and impersonation response. When a client reports a phishing email claiming to be from your domain, a DMARC lookup confirms the policy level and whether the attacker would have been rejected, quarantined, or let through.
• Incident evidence. The DMARC record state at the time of an incident is relevant to regulatory filings and law-enforcement referrals — the tool provides a point-in-time read of the published record.

05 · Interpretation

What to check in the result

Check these fields in order — the first failure is almost always the most important:

• Record exists. No DMARC record means no policy enforcement and no reporting. Publish one as soon as SPF and DKIM are in place — p=none with an rua= address is the safe starting point.
• Policy level. p=none is monitoring-only — messages that fail authentication still reach the inbox. Move to p=quarantine once aggregate reports show no false positives, then p=reject for full protection.
• Percentage at 100. pct= below 100 means only that fraction of failing messages gets the stated policy; the rest are treated as p=none. Useful during rollout, but it must reach 100 before you can claim full enforcement.
• Reporting address set. Without rua=, you have no visibility into who is sending on your behalf or where failures originate. Add at least one rua= address before any other policy change.
• Subdomain policy. If sp= is absent, subdomains inherit the parent policy. If your root is p=reject but you are launching a new subdomain, it is immediately protected — which can catch legitimate senders off-guard if not planned for.
• Alignment mode. adkim=s or aspf=s (strict) requires an exact From-header match to the authenticated domain. Use relaxed (r) for most setups unless you specifically need strict enforcement, as strict breaks subdomain sending.