# DMARC checker

> A DMARC checker reads the TXT record at _dmarc.yourdomain.com and explains it. It shows the policy (p=none, quarantine or reject), whether reports are being sent to you (rua), how strict SPF and DKIM alignment are, and whether the record is valid. You can check any domain free with the DMARC checker on this page.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: dmarc checker.

## Run the check

- In the browser: https://dmarccheckers.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/email-security/execute with {"target":"example.com"}

## What a DMARC checker looks at

- Whether a DMARC record exists at _dmarc on your domain, and that there is only one.
- The policy: p=none only monitors, p=quarantine sends failures to spam, p=reject blocks them.
- The subdomain policy (sp=) and the share of mail the policy applies to (pct=).
- Aggregate report addresses (rua=). Without them you cannot see who sends mail as you.
- Alignment (adkim=, aspf=): whether the From domain must match the SPF or DKIM domain exactly or only at the organisational level.

## DMARC policies compared

| Policy | What receivers do with failing mail | Protection |
| --- | --- | --- |
| p=none | Deliver it as normal and send you reports | Visibility only |
| p=quarantine | Put it in spam or junk | Partial |
| p=reject | Refuse it at the server | Full: spoofed mail never arrives |

## Moving from p=none to p=reject

Start at p=none with a rua address and read the aggregate reports for two to four weeks. List every service that sends for you and make sure each one passes SPF or DKIM with an aligned domain.

Then move to p=quarantine, and to p=reject once reports show only spoofed mail failing. p=reject is what actually stops attackers sending email that looks like it comes from you.

A monitoring-mode DMARC record that sends aggregate reports to you:

```
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r"
```

## Why DMARC matters now

Google and Yahoo require a DMARC record from bulk senders, and mail without one is more likely to land in spam. A domain with no DMARC policy, or one stuck at p=none, can be used in phishing that carries your exact address.

## FAQ

### What is a good DMARC policy?

p=reject is the goal: receivers block mail that fails DMARC. Reach it in stages, from p=none through p=quarantine, while you read reports and fix legitimate senders.

### Does DMARC need both SPF and DKIM?

DMARC passes when either SPF or DKIM passes with a domain that aligns with the visible From address. Set up both, because forwarding often breaks SPF while DKIM survives.

### Where is the DMARC record published?

As a TXT record on the _dmarc subdomain, for example _dmarc.example.com, starting with v=DMARC1.

### Is this DMARC checker free?

Yes. The check runs on vigilbase.com at no cost and needs no account.

## Related

- [Run the free email security check](https://vigilbase.com/tools/email-security)
- [Generate a DMARC record](https://vigilbase.com/tools/dmarc-generator)
- [Full email security check](https://vigilbase.com/tools/email-security)
- [SPF record generator](https://vigilbase.com/tools/spf-generator)
- [DMARC record generator](https://vigilbase.com/tools/dmarc-generator)
- [MTA-STS checker](https://vigilbase.com/tools/mta-sts-checker)
- [BIMI checker](https://vigilbase.com/tools/bimi-checker)