Free DMARC Record Checker & Policy Analyzer
Inspect published Domain-based Message Authentication, Reporting, and Conformance (DMARC) records, verify enforcement policy strength (p=reject vs. p=quarantine), and test aggregate reporting compliance in seconds with zero waiting queues. DMARC is the essential security standard required by Google Workspace and Yahoo Mail to protect your corporate domain from phishing scams, CEO spoofing, and unauthorized email impersonation. When receiving mail servers process your outbound communications, DMARC instructs them exactly how to handle messages that fail SPF or DKIM cryptographic alignment.
Our free DMARC policy inspector probes your domain's authoritative nameservers at _dmarc.yourdomain.com. In accordance with RFC 7489, Pingzo evaluates recursive organizational apex inheritance via the Public Suffix List (PSL), ensuring that corporate subdomains without explicit DMARC entries correctly inherit parent protection policies. We inspect the enforcement policy (p=), subdomain policy override (sp=), percentage filtering threshold (pct=), and validate destination mailto addresses for aggregate XML telemetry reports (rua=).
Without a properly published DMARC policy, threat actors can effortlessly spoof your business domain to trick customers, partners, and employees. While initial one-off checks help diagnose syntax errors or discover missing reporting tags, enterprise email deliverability requires continuous oversight. Pair your tests with Pingzo's automated 24/7 deliverability monitoring to receive instant multi-channel alerts via WhatsApp, Telegram, Slack, and Discord whenever your DMARC records are modified, deleted, or lapse into unverified states.
DMARC Policy Enforcement Guide & Syntax Reference
DMARC records are always published as DNS TXT records under the reserved hostname _dmarc.yourdomain.com. Below are the standard policy progression tiers used by leading engineering organizations:
Monitoring stage. Generates telemetry without blocking any mail. Used during initial setup to audit legitimate sending services.
Enforcement stage. Mail that fails SPF and DKIM alignment is routed directly to the recipient's junk/spam folder.
Full spoofing protection. Mail failing alignment is dropped immediately at the SMTP handshake before reaching the user.
Frequently Asked Questions
What is a DMARC record and why is it mandatory for email senders?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email security protocol published as a DNS TXT record at _dmarc.yourdomain.com. It connects SPF and DKIM authentication to protect your domain from impersonation, spoofing, and phishing attacks. Google and Yahoo mandate DMARC records for bulk and transactional email delivery.
What is the difference between p=none, p=quarantine, and p=reject?
p=none is an advisory monitoring policy where mailboxes deliver unauthenticated email normally while generating telemetry reports. p=quarantine instructs mailbox providers (Gmail, Outlook, Yahoo) to route unaligned messages directly into spam folders. p=reject is the maximum security enforcement tier that instructs receiving servers to block fraudulent mail outright before reaching the recipient.
How does DMARC policy inheritance work across subdomains?
If a sending subdomain (e.g., mail.yourcompany.com) does not publish its own dedicated _dmarc record, mailbox providers recursively query the root organizational apex domain (yourcompany.com) using Public Suffix List rules. Subdomains inherit the apex policy unless an explicit sp= tag overrides it.
What is the rua aggregate reporting tag in a DMARC record?
The rua tag (e.g., rua=mailto:dmarc-reports@yourdomain.com) specifies an email endpoint where major inbox providers send daily XML reports detailing all servers sending email on behalf of your domain, including pass/fail rates for SPF and DKIM.
Why should I monitor my DMARC records continuously?
DNS records can be accidentally deleted during registrar migrations or misconfigured by team members. If your DMARC record breaks or your policy lapses, malicious actors can spoof your domain and legitimate delivery rates will degrade immediately.
Related Developer Tools
SPF Record Checker
Validate SPF syntax, evaluate 10-lookup limits, and detect PermErrors.
DKIM Record Validator
Inspect DKIM selector keys, verify RSA bit lengths, and detect drops.
SPF & DMARC Generator
Generate compliant SPF and DMARC TXT records for email providers.
DNS Records Lookup
Query A, AAAA, MX, CNAME, TXT, and NS records directly from root servers.