Free DMARC Tools Compared: Checkers, Generators and Report Viewers

What does “free DMARC tool” actually mean?

When people search for a free DMARC tool they are usually after one of three quite different things, and confusing them is the single biggest reason teams pick the wrong one.

• Point-in-time checkers. You type a domain, the tool reads the live DNS, and it tells you what your current _dmarc, SPF and DKIM records say. No account, no ongoing data. These answer “is my record valid right now and is my policy strong enough?”
• Free monitoring tiers.You create an account, point your domain's rua= tag at the vendor, and they ingest your DMARC aggregate reports over time. These answer “who is actually sending as my domain, and is my legitimate mail aligning?” They are free up to a domain cap and a retention window, then you pay.
• Deliverability analytics. A separate category that reports on how your mail is treated once it reaches a specific mailbox provider. Useful, but not a DMARC record checker or an aggregate-report viewer.

If you only ever want to validate a record, a point-in-time checker is free forever and is all you need. If you want to know what is being sent in your name, you need report ingestion, and that is where the free-versus-paid decision actually lives. For the difference between those reports and the records themselves, our guide to understanding DMARC reports walks through a real aggregate XML file row by row.

Which free DMARC checkers work with no signup?

Every credible DMARC vendor publishes at least one free, no-account checker, partly as a genuine service and partly as a shop window. They are interchangeable for the basic question “does my record parse and is the policy at least p=quarantine?” They differ in how much surrounding context they give you.

• dmarcian Domain Checker. The dmarcian Domain Checker runs without a signup. Enter a domain and it inspects the DMARC, SPF and DKIM records and reports policy strength and configuration issues. dmarcian was founded by one of the primary authors of the DMARC specification, so its interpretation of the spec is about as authoritative as it gets.
• EasyDMARC tools. EasyDMARC publishes a suite of 30+ free standalone tools at its tools page, including a DMARC lookup, SPF record check and DKIM lookup, all usable without creating an account. The breadth across DMARC, SPF, DKIM, BIMI, DNS, MTA-STS and TLS-RPT is the main draw.
• MXToolbox SuperTool. MXToolbox provides free DMARC, SPF and DKIM record tests plus record generators through its DMARC email tools, all usable without signup. It is the long-standing default for quick DNS diagnostics, although DMARC report aggregation is a separate paid product (see below).
• PowerDMARC Toolbox. The PowerDMARC Toolbox offers a DMARC checker, SPF checker, DKIM analyser, a combined domain analyser that scores DMARC, SPF, DKIM, MTA-STS, TLS-RPT and BIMI together, and a standalone XML aggregate-report analyser, all without signup.
• ShieldMarc tools.ShieldMarc publishes 20+ free, no-signup tools, each carrying a “100% free, no sign-up needed” badge. They include a DMARC Checker, a DMARC report viewer, a free SPF checker, a free DKIM checker and record generators for DMARC, SPF, DKIM and CAA. The differentiator is the Security Grade, which scores every email-authentication and DNS layer in one scan rather than making you run six separate lookups.

The honest summary: for a one-off record check, pick whichever interface you find clearest. The result will be the same because they are all reading the same public DNS. What separates them is what happens after the check, when you want to track senders over time.

Is there a free DMARC report viewer?

Yes, in two forms, and the distinction matters. The first is a stateless report viewer: you already have an aggregate report XML file (most providers email these as gzipped attachments), and you paste or upload it to see the source IPs, message counts and pass/fail breakdown in a readable table. ShieldMarc's DMARC report viewer and PowerDMARC's XML analyser both do this with no account. It is perfect for a one-time “what is in this file?” question.

The second form is a continuous report viewer, which is really a monitoring tier: the vendor receives every report for your domain automatically, deduplicates across reporters, enriches source IPs and keeps history so you can see trends. A stateless viewer shows you one report; a monitoring tier shows you the picture across weeks. The free monitoring tiers below all provide the continuous kind up to a cap.

A practical warning about the stateless route: aggregate reports arrive from dozens of reporters, on their own schedules, in slightly different dialects. Reading one file by hand is fine. Reading forty a week by hand, deduplicating them and spotting the one new unauthorised sender among them is not a sustainable manual process, which is the whole reason monitoring tiers exist.

Which DMARC platforms offer a genuinely free monitoring tier?

These are the tools that ingest your aggregate reports for free, with the catch being domain caps, message caps and short retention windows. The figures below are taken from each vendor's own pricing page.

• EasyDMARC Free. The EasyDMARC Free plan covers 1 domain, 1,000 emails per month and 14 days of data history, with access to both aggregate (RUA) and failure (RUF) reports, and no credit card. Paid tiers (Plus, Premium, Enterprise) start above that. For a single small-business domain this is one of the two best free monitoring options.
• dmarcian Personal. dmarcian's Personal plan is free with no card and covers up to 2 active domains, 1 user, 1,250 DMARC-capable messages per month and 1 month of data history. The important restriction: it is for non-business or personal domains only, and dmarcian audits accounts and expires any Personal plan attached to a business. It is the other strong single-domain free option, with the caveat that a company domain does not qualify.
• Valimail Monitor. Valimail Monitor is genuinely free with no trial, no credit card and no obligation. It provides aggregate-report visibility, sender discovery and inventory (it names the sending services it identifies), pass/fail status and detection of unauthorised senders. The paid Enforce and Amplify tiers are quote-based and sales-gated. This is a free tier, not a trial, which makes it a real option for visibility on a single domain.
• ShieldMarc Starter. ShieldMarc's Starter plan is free and monitors exactly 1 DMARC domain, with 10,000 DMARC messages per month and 365-day retention. The retention is far longer than the other free tiers (a full year against 14 days or 1 month), but Starter is deliberately a one-domain evaluation tier, not a long-term home for a single domain. More on why below.

Some platforms describe a free trial rather than a free plan. A DMARC Analyzer 14-day trial and a URIports free trial both exist, and PowerDMARC offers a 15-day trial with no card via its toolbox. Trials let you evaluate the full product, but they expire, so treat them as a different category from the free-forever tiers above. (DMARC Analyzer is now part of Mimecast, so confirm current branding before relying on it as a standalone product.)

Is Google Postmaster Tools a free DMARC tool?

Not in the sense most people mean. Google Postmaster Tools is free, but it is a Gmail-side deliverability and analytics dashboard: domain reputation, IP reputation, spam rate, encryption, delivery errors and the SPF, DKIM and DMARC authentication pass-rates of mail you send to Gmail. It is not a DMARC record checker, and it is not an aggregate-report (RUA) viewer. It also needs roughly 100+ emails per day to Gmail before it shows useful data, so a low-volume domain sees nothing.

That makes it complementary, not competing. Postmaster Tools tells you how Gmail specifically treats your mail; a DMARC monitoring tool tells you what every reporting receiver sees across all your mail streams. Run both if you send meaningful volume to Gmail. Just do not expect Postmaster Tools to validate your _dmarc record or replace report ingestion.

Free DMARC tools at a glance

The table groups the options by what they actually are. Read the kind column first: a point-in-time checker and a free monitoring tier answer different questions, so “which is best” depends on which question you have.

For a wider feature-by-feature look at the paid platforms behind several of these free tiers, see our best DMARC monitoring tools 2026 comparison, and the head-to-head ShieldMarc versus EasyDMARC and ShieldMarc versus dmarcian pages.

What is the best free DMARC tool for a single small-business domain?

If you run one domain for a small business and you want free ongoing monitoring, the honest answer is EasyDMARC's Free plan or, if the domain genuinely is personal rather than a business, dmarcian's Personal plan. Both ingest your aggregate reports, both cost nothing, and both are built and priced for exactly that single-domain situation. EasyDMARC Free handles a business domain (1 domain, 1,000 emails per month, 14-day history); dmarcian Personal is the better-retention option (1 month of history) but is restricted to non-business domains and audited accordingly.

We would rather tell you that plainly than pretend ShieldMarc is the right tool for one small-business domain. It is not, and the pricing makes that obvious: the first ShieldMarc paid plan starts at 25 domains. The free Starter tier exists so a prospective MSP or multi-domain team can evaluate the product on one real domain (with a full year of retention, which is unusually generous for a free tier), not as a permanent single-domain home. If you only ever have one domain, you will get more from a tool designed for that.

When should an MSP or multi-domain team move off free tools?

Free tools and free tiers break down at exactly the point that defines an MSP or a multi-domain IT team: scale and the work between the data and the decision. The honest signals that you have outgrown free:

• More than one or two domains. Free monitoring tiers cap at 1 to 2 domains. The moment you manage a handful of client domains, you are either juggling several free accounts (no consolidated view, no cross-domain alerting) or paying.
• You need real retention. A 14-day or one-month history is fine for a quick look but useless for proving a trend, completing a security questionnaire or investigating an incident from last quarter. Enforcement decisions are easier with months of clean data behind them.
• You want the analysis done for you. Free tiers show you the reports. They generally do not provide AI-assisted explanation, a single composite score across every DNS and authentication layer, or threat scoring that tells you which unauthorised sender is a real risk rather than a forwarder.
• You need alerting and integrated monitoring. Point-in-time checkers tell you nothing tomorrow. A new unauthorised sender, an expiring certificate or a DMARC record someone edited by hand should page you, not wait for the next manual check.

ShieldMarc is built and priced for that point. The Professional plan is £49/month billed annually (£69 month-to-month) and covers 25 domains, 5 team members and 1,000,000 messages per month. The MSP plan is £99/month billed annually (£129 month-to-month) and covers 100 domain slots with brand-domain grouping, so the TLD variants of one brand (the .com, .co.uk and .org of a client) count as a single slot, plus unlimited team members, 5,000,000 messages per month and an optional +50 domain slots for £39.99/month. Data is EU hosted by default, with UK hosting available on request, which matters for UK procurement and NHS trusts working through the post Mail Check transition. The 25-domain entry threshold is the deliberate signal of who the paid product is for: not a single small business, but teams managing many domains.

Can free tools take me all the way to p=reject?

Free tools can absolutely help you get started, and a free checker is the right way to confirm your record is valid at each step. But reaching p=reject safely is not a record-editing exercise, it is a data-reading one. The correct progression is to publish p=none first, then actively read your parsed aggregate reports until every legitimate sender is identified and aligning on SPF or DKIM, and only then advance none to quarantine to reject when the data is clean. That is exactly the loop a monitoring tool (free tier or paid) supports and a one-off checker cannot. Our none to reject guide walks through the full progression, and what is DMARC covers the basics if you are new to it.

One tag to know about but not to rely on: the pct= tag, which controls what percentage of failing mail gets your stated policy. There is a quirk worth understanding from RFC 7489 §6.3: pct=50 does not mean “half your mail” in a simple sense, it means 50% of failing messages get the p= policy and the remaining 50% get the next-lower policy (so under p=reject; pct=50 half are rejected and half are quarantined). ShieldMarc does not recommend ramping pct= as a rollout strategy. It creates an inconsistent, hard-to-reason-about enforcement state and it does not make your mail any safer. The report-driven progression above, advancing only when the data is clean, is the approach we build the readiness indicator around.

Are free SPF and DKIM checkers as good as paid ones?

For validation, yes. A free SPF checker reads your v=spf1 record, counts your DNS lookups against the limit of 10 set in RFC 7208 §4.6.4, and flags whether you end in -all or ~all. A free DKIM checker confirms a selector resolves and the public key is published. Those are deterministic checks: a free tool and a paid tool reading the same DNS will agree. ShieldMarc's SPF checker and DKIM checker are free and require no signup, as is the SPF flattener for when you breach the 10-lookup limit. For the conceptual difference between the three mechanisms, see SPF vs DKIM vs DMARC.

Where paid tools pull ahead is not the lookup itself but the ongoing question: did your SPF record drift past 10 lookups last week because a vendor changed their include, and did anyone get told? A point-in-time SPF checker answers “is it correct now?” A monitoring platform answers “tell me when it stops being correct.” If you generate a new record from scratch, the DMARC record generator and the DNS lookup tool are also free and account-free.

How do I choose between all these free tools?

Work backwards from the question you actually have.

• “Is my record valid right now?” Use any no-signup checker. They are equivalent. Pick the clearest interface, or one (like the ShieldMarc Security Grade) that scores every layer in one pass.
• “What is in this one report file?” Use a stateless report viewer that accepts an upload. No account needed.
• “Who is sending as my one small-business domain over time?” Use EasyDMARC Free or dmarcian Personal (the latter only if the domain is non-business). Both are free monitoring built for a single domain.
• “How does Gmail treat my mail?” Use Google Postmaster Tools alongside, not instead of, a DMARC tool.
• “I manage many domains (or client domains) and need consolidated monitoring, alerting, retention and analysis.” That is where free stops scaling and a paid platform earns its keep. For UK MSPs and multi-domain teams, that is the segment ShieldMarc is built for.