Free SPF, DKIM & DMARC Checker
To check if a domain has DMARC set up, enter it below: this free checker looks up the DNS TXT record at _dmarc.<yourdomain> and reads its policy, then analyses the SPF record and DKIM alignment too. You get an A+ to F graded breakdown across 7 categories, with clear recommendations you can act on to improve your email security posture. No sign-up needed.
Want to check your primary and alternate brand domains together? Use the Security Grade for a full domain trust assessment across all security layers.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that protects your domain from spoofing, phishing and business email compromise. It builds on SPF and DKIM to give domain owners control over what happens when an email fails authentication.
Why You Need DMARC
- Prevent Phishing: Stop attackers from sending emails that appear to come from your domain.
- Improve Deliverability: Major providers like Google and Microsoft prioritise domains with strong DMARC policies.
- Regulatory Compliance: DMARC is increasingly required by regulations including PCI-DSS v4 and the UK NCSC.
- Brand Protection: Protect your brand reputation from domain spoofing attacks. DMARC stops spoofing of your exact domain, but attackers can also register lookalike domains. Scan for these with our Lookalike Domain Scanner.
UK MSP DMARC Audit: updated quarterly
We used this tool to audit the DMARC posture of 192 UK Managed Service Providers in Q1 2026. Only 5% achieved an Excellent rating when brand domain protection was factored in. The Q2 2026 re-scan grades the same providers A+ to F: the average MSP scores a C and only 6% earn an A. Both reports include regional breakdowns and what the NCSC Mail Check retirement means for UK organisations.
Need Ongoing DMARC Monitoring?
This free tool is perfect for quick checks. But a one-off scan cannot tell you who is sending email as your domain right now. With ShieldMarc monitoring, you get parsed DMARC aggregate reports, sender visibility, alignment tracking, and alerts when something changes. Start a free trial.
Want a complete picture?
Our Security Grade scans DMARC, SPF, SSL/TLS, DNSSEC, registration, and expiry across your primary and alternate brand domains in one click.
What is a DMARC checker?
A DMARC checker is a free tool that looks up the DMARC record in your domain's DNS (at _dmarc.yourdomain.com) and tells you whether it exists, which policy it uses (none, quarantine or reject) and whether it is set up correctly. This checker goes further: it grades your DMARC, SPF and DKIM alignment from A+ to F across 7 categories and adds a plain-English AI explanation of exactly what to fix, with no sign-up needed. For continuous monitoring across many domains, the same engine powers ShieldMarc's paid reporting.
How do I check if my domain has DMARC set up?
DMARC lives in a DNS TXT record at the hostname _dmarc.yourdomain.com. The fastest way is to paste your domain into the checker above, which queries that record and grades it. To check it yourself, run dig TXT _dmarc.yourdomain.com +short on macOS or Linux, or nslookup -type=TXT _dmarc.yourdomain.com on Windows. A configured domain returns a value starting v=DMARC1; if nothing comes back, no DMARC record is published.
How do I look up a DMARC record?
A DMARC record is always a TXT record at the special subdomain _dmarc under your domain, so you look it up by querying _dmarc.yourdomain.com rather than the bare domain. The checker above does this lookup and explains every tag in plain English. The record format is defined in RFC 7489, the original DMARC specification, obsoleted in May 2026 by DMARCbis (RFC 9989).
What is the best free DMARC checker?
The best free DMARC checker is one that reads your policy and explains what to fix, not just whether a record exists. This checker is 100% free with no sign-up: it grades DMARC, SPF and DKIM alignment from A+ to F across 7 categories and adds a plain-English AI explanation of the result. For multi-domain IT teams and UK MSPs that need continuous monitoring of who is sending as your domain, the same engine powers ShieldMarc's paid reporting from £0 to £100 per month.
How do I verify a DMARC record using dig?
Run dig TXT _dmarc.yourdomain.com +short from a terminal. A valid record is returned as a quoted string beginning v=DMARC1; p=.... Watch for two common faults: a record published at the bare domain instead of the _dmarc label, and more than one DMARC TXT record on the same name, which DMARC verifiers treat as no record at all.
How long does it take for a DMARC record to work?
DMARC records take effect as soon as they propagate through DNS, typically within minutes to a few hours. However, you will not start receiving aggregate reports until email receivers process messages sent from your domain, which usually takes 24 to 48 hours.
Should I start with p=none or p=reject?
For domains that actively send email, start with p=none and configure rua= reporting. Monitor your reports for 2 to 4 weeks to identify all legitimate sending sources, then move to p=quarantine and finally p=reject. For domains that do not send email (parked or defensive), go straight to p=reject.
Can DMARC break my email?
A DMARC policy of p=quarantine or p=reject will affect emails that fail authentication. This is why monitoring with p=none first is important: it lets you identify and fix legitimate senders (marketing platforms, CRMs, etc.) before enforcement. Emails sent directly from your mail provider (Google Workspace, Microsoft 365) are almost always aligned and will not be affected.
Do I need both SPF and DKIM for DMARC?
DMARC requires only one of SPF or DKIM to pass and align. However, best practice is to configure both. SPF validates the sending server, while DKIM validates the message content. Having both provides redundancy and improves deliverability.
What is a good DMARC grade?
Our checker grades domains from A+ to F. A or A+ means your domain has strong enforcement with p=reject, strict alignment, and active reporting. Use the Security Grade for a broader assessment that includes SSL, DNSSEC, MTA-STS, and more.
Why does my SPF grade the same with ~all and -all?
For DMARC purposes, both ~all (soft fail) and -all (hard fail) grade the same because DMARC enforcement handles rejection at the policy level. However, the Security Grade evaluates them differently: non-mail domains require strict -all to reach higher trust levels.