Free DMARC Checker
Check whether your domain has a DMARC record, and whether it is actually enforced, in about thirty seconds. It runs as part of a free, passive snapshot of your whole external surface.
What DMARC is
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails your SPF and DKIM checks. It is the control that actually stops attackers from sending phishing that looks like it came from you, and it gives you reporting on who is trying.
Why it matters
Without an enforced DMARC policy, anyone can send email that appears to come from your domain, and your customers, suppliers and staff have no automatic way to tell the fake from the real. That is exactly how invoice fraud and brand-impersonation phishing work. A published policy at quarantine or reject shuts that door.
How to read your result
The check looks up the _dmarc record at your organisational domain, the same way a receiving mail server does. It flags three states: no DMARC record at all (a high-severity gap), a record set to p=none which only monitors and does not block spoofed mail (a medium gap), or an enforced policy at quarantine or reject, which passes.
How to fix it
Publish a DMARC TXT record at _dmarc.yourdomain. Start at p=none with a reporting address (rua=) so you can see who is sending as you, then move to p=quarantine and finally p=reject once your legitimate mail is aligned. Keep SPF and DKIM in place so your own email keeps passing.
See your whole external surface
This is one of the checks in Secvura’s free Surface Check. The same passive snapshot also covers your TLS certificate, cookies, the rest of your email security, and more, each scored by severity and fix effort, with an A-to-F Surface Score.
Run the full Surface Check →Frequently asked
Is the DMARC check free?
Yes, completely free, with no sign-up. Enter your domain and you get the result straight away, along with the rest of your external surface.
Do I need SPF and DKIM as well?
Yes. DMARC relies on SPF and DKIM to decide whether a message is legitimate, so all three work together. The same snapshot checks your SPF and looks for DKIM at the same time.
What is the difference between p=none, quarantine and reject?
p=none only monitors and reports; it does not stop spoofed mail. p=quarantine sends failing mail to spam. p=reject blocks it outright. Most domains start at none to observe, then move to quarantine and reject.
More free checks