Free tool
DMARC checker
A DMARC checker reads the TXT record at _dmarc.yourdomain.com and explains it. It shows the policy (p=none, quarantine or reject), whether reports are being sent to you (rua), how strict SPF and DKIM alignment are, and whether the record is valid. You can check any domain free with the DMARC checker on this page.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
What a DMARC checker looks at
- Whether a DMARC record exists at _dmarc on your domain, and that there is only one.
- The policy: p=none only monitors, p=quarantine sends failures to spam, p=reject blocks them.
- The subdomain policy (sp=) and the share of mail the policy applies to (pct=).
- Aggregate report addresses (rua=). Without them you cannot see who sends mail as you.
- Alignment (adkim=, aspf=): whether the From domain must match the SPF or DKIM domain exactly or only at the organisational level.
DMARC policies compared
| Policy | What receivers do with failing mail | Protection |
|---|---|---|
| p=none | Deliver it as normal and send you reports | Visibility only |
| p=quarantine | Put it in spam or junk | Partial |
| p=reject | Refuse it at the server | Full: spoofed mail never arrives |
Moving from p=none to p=reject
Start at p=none with a rua address and read the aggregate reports for two to four weeks. List every service that sends for you and make sure each one passes SPF or DKIM with an aligned domain.
Then move to p=quarantine, and to p=reject once reports show only spoofed mail failing. p=reject is what actually stops attackers sending email that looks like it comes from you.
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r"Why DMARC matters now
Google and Yahoo require a DMARC record from bulk senders, and mail without one is more likely to land in spam. A domain with no DMARC policy, or one stuck at p=none, can be used in phishing that carries your exact address.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Email security
Phishing protection and DMARC enforcement, set up and kept current for you.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreVigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreFrequently asked questions
What is a good DMARC policy?
p=reject is the goal: receivers block mail that fails DMARC. Reach it in stages, from p=none through p=quarantine, while you read reports and fix legitimate senders.
Does DMARC need both SPF and DKIM?
DMARC passes when either SPF or DKIM passes with a domain that aligns with the visible From address. Set up both, because forwarding often breaks SPF while DKIM survives.
Where is the DMARC record published?
As a TXT record on the _dmarc subdomain, for example _dmarc.example.com, starting with v=DMARC1.
Is this DMARC checker free?
Yes. The check runs on vigilbase.com at no cost and needs no account.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.