coldemailinboxes.io
TOOL: DMARC CHECKER

Free DMARC Checker

Read the DMARC policy published at _dmarc for any domain and see how receivers are told to treat failing mail. One domain, or up to 100 in a list.

What this checker does

It queries _dmarc.yourdomain.com for a TXT record, parses the policy, and reports each tag: the policy itself, the subdomain policy, the percentage of mail it applies to, and the addresses receiving aggregate and forensic reports.

The lookup is live and uncached, so a record published minutes ago appears as soon as DNS has propagated.

Reading the result

Policy is what receivers do with mail that fails. none monitors only, quarantine sends failures to spam, and reject refuses them at the gateway.

Percentage applies the policy to a fraction of mail. A record at p=reject; pct=10 is far weaker than it looks: ninety percent of failures are still delivered.

Reporting addresses are where aggregate data goes. Without an rua address a policy runs blind, and you discover problems from bounced campaigns rather than from reports.

Failures that look fine

Record at the wrong name. It must be at _dmarc. as a subdomain of the sending domain. At the root it is invisible to receivers.

Enforcing before the reports are clean. Moving to reject while a legitimate sender is still failing alignment blocks real mail, and the failure is silent from your side.

Policy on the wrong domain. Cold email runs on dedicated sending domains. A strong policy on the primary domain does nothing for a campaign sending from another one.

How do I check DMARC for many domains at once?

Switch to Bulk list and paste up to 100 domains, one per line, or load a text or CSV file and the first column is used. Each domain comes back as a row: verdict, the policy, the subdomain policy, the percentage the policy applies to, and whether aggregate reports are being collected. Download the table as CSV.

The limit is 100 domains per batch and three batches a minute, the same for a guest and a signed-in user. Reading a client's whole domain set before moving any of them from p=none is the case it is built for.

Common questions

Yes. Switch to Bulk list, paste up to 100 domains one per line or load a CSV, and every row comes back with its verdict, policy, subdomain policy, percentage and whether reports are collected. Download the table as CSV. The same limit applies whether or not you are signed in.

In a TXT record at _dmarc.yourdomain.com, not at the root of the domain. A record published at the root instead is the single most common reason a lookup returns nothing while the owner is certain they set it up.

Start at p=none. It enforces nothing and simply collects reports, which is what you need to discover every legitimate sender before enforcement starts breaking mail. Move to quarantine once the reports are clean, then reject. Jumping straight to reject reliably blocks something you forgot about.

rua receives aggregate reports: daily XML summaries of authentication results across all mail claiming to be from your domain. ruf receives forensic reports on individual failures, and many providers do not send them at all for privacy reasons. rua is the one worth configuring.

DMARC passes only when SPF or DKIM passes AND the domain it authenticated matches the domain in the visible From address. A sending platform can pass SPF against its own domain while failing alignment against yours, which is why SPF can look healthy while DMARC fails.

Yes, unless sp= says otherwise. The sp tag sets a separate policy for subdomains. If it is absent, subdomains inherit p=. Cold email sent from a subdomain is governed by whichever applies.

Related