Free diagnostic
Inspect a domain's DMARC record, effective policy, inheritance, testing mode, and aggregate-reporting configuration.
A DMARC record tells receivers how to handle messages that fail aligned SPF and DKIM. This tool reports the published policy and whether aggregate reporting is configured.
Use DMARC monitoring to label sources, inspect alignment volume, identify unknown senders, and plan controlled enforcement.
Diagnostic bridge
Use the checker when the question is publication. Use monitoring when the question is whether real senders align, whether unknown sources remain, and whether enforcement can safely change.
Label sources, inspect SPF/DKIM alignment over time, and plan enforcement.
Understand RUA ingestion, source attribution, alerts, and rollout evidence.
See why raw SPF/DKIM passes can still fail DMARC alignment.
Fundamentals
DMARC (Domain-based Message Authentication, Reporting, and Conformance), defined by RFC 9989, lets a domain publish a policy telling receivers how to handle mail that claims to come from it but fails authentication, and where to report what they saw. The policy lives in a public DNS TXT record at _dmarc.<yourdomain> starting with v=DMARC1, which is exactly what this checker reads. DMARC authenticates nothing itself; it builds on SPF and DKIM by adding alignment. A message passes when SPF passes with a Return-Path domain aligned to the visible From domain, or when a valid DKIM signature's d= domain aligns with it; one aligned pass is enough. adkim and aspf set the mode: r (relaxed, the default) lets subdomains match; s (strict) requires exact. DMARC alignment explained has the worked cases. The remaining tags tune behavior. p is the policy for the domain; sp covers existing subdomains, np covers non-existent subdomains, and t=y enables the RFC 9989 testing step. rua lists aggregate-report addresses, while ruf and fo configure optional failure reporting. SPF, DKIM, and DMARC explained covers the three protocols together.
Reading the output
This tool runs the bounded RFC 9989 DNS tree walk and reports the applicable published policy. It is anonymous, rate limited, and retains nothing you submit; no SMTP connection is opened and no mailbox is probed. Every result has a status, evidence, limitations, and an RFC 9989 link.
Troubleshooting
Most DMARC problems come from a small set of patterns. Several show up in this tool's output; the rest surface in the aggregate reports a correct record unlocks.
Providers
DMARC is one standard, but large mailbox providers differ in what they require, how they apply policies, and how reliably they report back.
Comparison
All three show a DMARC record, but they are built around different jobs. MXToolbox offers free ad-supported one-off lookups, with paid monitoring from $129 per month. dmarcian is a DMARC-focused paid suite. WillItInbox runs free checks with no login and no domain retention, plus optional DMARC monitoring (see the docs) that turns reports into a labeled sender inventory.
| Capability | WillItInbox | MXToolbox | dmarcian |
|---|---|---|---|
| DMARC lookup | Free, one-off, live DNS | Free, one-off, ad-supported | Part of a paid DMARC suite |
| Effective policy, inheritance, testing, and rua readout | Yes, in free check | Yes, as record detail | Yes, within the suite |
| Login required | No for free checks | No for free lookups | Account-based platform |
| Submitted-domain retention | None for public checks | Varies by product | Varies by product |
| Aggregate-report monitoring | Optional monitoring that builds sender inventory | Paid plans from $129/mo | Core paid offering |
Live diagnostic
This anonymous tool is rate limited and does not retain submitted input. It reports observable evidence without promising delivery, authentication alignment, or inbox placement.
No SMTP mailbox probing, account lookup, or tenant data is used.
Related
Move from monitoring to enforcement safely.
Inspect adjacent SPF publication.
Turn aggregate reports into sender intelligence.
See how SPF, DKIM, DMARC, BIMI, MTA-STS, and TLS-RPT evidence becomes a remediation checklist.
Connect aggregate reports, source attribution, policy status, and alerts to the sender authentication dashboard.
Track DNS, TLS-RPT, provider reputation, and placement signals for the domains that carry production mail.
Compare validation volume, monitoring, API access, reporting, and workspace limits by plan.
FAQ
It asks receivers to take no action on failing mail: messages are delivered normally, and reports still flow to your rua address. A disposition of "none" in a report does not mean the message passed; it means no enforcement was requested. p=none is the correct first stage for collecting evidence, not a destination.
In a TXT record at _dmarc.yourdomain.com, not at the apex. When a subdomain has no record, discovery falls back to the organizational domain's record, and the sp tag governs subdomains. A record anywhere else is never evaluated.
The usual causes are a missing or mistyped rua tag, a mailbox that is full, filtered, or unread, and an rua address in another domain without the required authorization record under _report._dmarc. Reports also arrive roughly daily and only from receivers that send them, so a quiet inbox proves nothing. Confirm the record and mailbox, then wait several days.
rua receives aggregate reports: gzipped XML summaries, typically daily, of volume and pass/fail by source. ruf receives forensic reports: near-real-time copies of individual failing messages. Aggregate data is widely supported and is the foundation of monitoring; forensics are largely deprecated over the personal data they contain, and most large receivers never send them.
Yes. DMARC needs only one aligned pass: SPF with an aligned Return-Path domain, or DKIM with an aligned d= domain. Forwarded mail is the common case: forwarding breaks SPF, but a DKIM signature survives. A valid DKIM signature on an unrelated domain does not count; alignment is what decides.
There is no fixed calendar answer; the reports decide. Stay until every legitimate stream passes aligned authentication, including infrequent senders like monthly invoicing. Then test quarantine with t=y before removing testing mode. General-purpose domains should assess interoperability carefully before considering reject.
No. The tool runs live DNS queries and shows the applicable policy with its limitations and an RFC 9989 link. It needs no login, opens no SMTP connection, probes no mailbox, and retains nothing you submit. It reports DNS evidence only; it does not promise enforcement, alignment, or inbox placement.
