DMARC checker
Check whether anyone can send email pretending to be your domain. Reads DMARC, SPF, DKIM and MX records, explains each one and says what to fix for Gmail and Yahoo.
- Fake emailCan someone send mail pretending to be you?
- Inbox rulesSPF, DKIM and DMARC as Gmail and Yahoo want them
- Where mail goesMail servers and the provider behind them
Related tools
See all toolsHow to use the DMARC checker
Type your domain, or paste any email address at that domain, and press Check email. The DMARC checker reads the domain's email records from public DNS and answers one question first: can someone send email that pretends to come from you? Then it explains each record and what to fix. If you know your DKIM selector, the s= value in the DKIM-Signature header of an email you sent, add it under Your DKIM selector and it is tried first.
What the email authentication checker reads
- DMARC tells inboxes what to do with mail that claims to come from your domain but fails the checks: nothing, send it to spam, or refuse it. The checker shows the policy for the domain, for its subdomains and for made-up subdomains, where reports go, and how strictly the domains must match. It follows RFC 9989, the DMARC standard of 2026, which retired the old pct tag.
- SPF lists the servers allowed to send mail for the domain. The SPF checker counts every DNS lookup the record needs, following each include. Past ten lookups, receivers give up and SPF fails, a common problem once several services are added over the years. It also explains the ending rule:
-allrefuses others,~allmarks them as suspicious, and+alllets anyone send as you. - DKIM signs each message so receivers can tell it was not changed. DNS cannot list a domain's DKIM keys, so the DKIM checker tries the selector names the big providers use, such as Google Workspace, Microsoft 365, Mailchimp, SendGrid, Fastmail and Zoho, and reports the key size it finds.
- MX lookup: where your mail goes, and the provider behind the servers.
- Extras: MTA-STS, which makes other servers insist on encryption when they deliver to you; TLS reports; and BIMI, which shows your logo beside your mail in some inboxes.
Gmail and Yahoo sender rules
Since February 2024, Gmail and Yahoo require anyone who sends a lot of mail to their users to have SPF, DKIM and a DMARC record. Smaller senders need at least SPF or DKIM. The checker says whether your domain meets the bulk sender rules, because mail that fails them is filtered or rejected.
Privacy and limits
The records are read from your browser through Cloudflare's public DNS resolver, or Google's when Cloudflare does not answer. Nothing is sent to your mail server and no email is sent. A DKIM key with an unusual selector name can be missed; that is why the result says "None found" and how many common selectors it tried, rather than "no DKIM". See the privacy page.
Questions
Which DMARC policy should I use?
Start with p=none and a report address, read the reports for a few weeks, then move to quarantine and finally reject once all your real mail passes.
My domain sends no email. Do I need these records?
Yes, because scammers like unused domains. Publish v=spf1 -all and a DMARC record with p=reject, and nobody can send mail in its name.
Where else should I look?
The same check also fills the other sections: Domain shows who registered the domain and when, like the WHOIS lookup, and the summary at the top sums up the site itself, as the website checker does.