DMARC analyzer
Check a DMARC record: policy, subdomain policy, pct and report addresses, with a diagram of what receivers do. Look it up in DNS or paste records.
Runs in your browser · nothing is sentEmail securityNew
A look-up sends only the domain name and the record type to Cloudflare’s DNS service (cloudflare-dns.com). Nothing else leaves your browser. Choose “Paste records” to stay fully offline.
How to use
- Enter your domain, for example example.com.
- Select Check. The tool reads _dmarc.your-domain.
- Read the findings and the diagram, then adjust the record at your DNS provider.
Common scenarios
Publish p=none with a rua address, collect reports for a few weeks and then raise the policy.
If sp is weaker than p, attackers can use subdomains. Check the subdomain policy.
SPF analyzer →About this tool
Enter a domain to read its DMARC record from DNS, or paste it to stay offline. The tool explains the policy, checks subdomain handling, the pct value and the report addresses, and draws what a receiver does with a message that fails SPF and DKIM. If the domain has no record of its own, the organizational domain is checked, like receivers do.
🔒 Your input stays in your browser and is never sent anywhere.
Frequently asked questions
What is the difference between none, quarantine and reject?
none only monitors and delivers failing mail as normal. quarantine asks receivers to treat it as suspicious, usually the spam folder. reject asks them to refuse it. Most domains start at none, read the reports and then move up.
Why do I need rua?
rua sets where aggregate reports are sent. They show which servers send mail as your domain and whether it passes SPF and DKIM. Without them you cannot safely move to quarantine or reject.
What does pct do?
pct applies the policy to only a percentage of failing mail. It is meant for a gradual roll-out. Set it to 100 (or leave it out) once reports look clean.
What to do next
Found a problem or have a suggestion? Tell us