DMARC check
Is your domain protected against forged senders?
Enter a domain and get the result in seconds. The check covers DMARC, SPF, DKIM and transport security via MTA-STS and TLS-RPT. No sign-up, and the domain you check is not stored.
What is being checked
DMARC
Defines what receivers should do with mail that matches the sender domain through neither SPF nor DKIM. Without enforcement, spoofing has no consequences.
SPF
Lists the servers allowed to send for the domain. The record may trigger at most ten DNS queries, otherwise receivers treat it as an error.
DKIM
Signs outgoing mail cryptographically. Unlike SPF, a valid signature also survives forwarding.
MTA-STS and TLS-RPT
Keep the transport to the domain encrypted and make failures visible.
Frequently asked questions
Are the checked domains stored?
No. The check consists of public DNS queries, the result is returned to the browser only and is not persisted anywhere.
Why is no DKIM found although we use DKIM?
DKIM keys live under a freely chosen selector. DNS only allows guessing known names, so a selection of common selectors is probed.
Is this check enough to roll out DMARC?
No. It shows the state in DNS. Tightening to quarantine or reject requires the aggregate reports from receivers, otherwise you block your own services.
What does the grade mean?
The score starts at 100 and is reduced per finding, critical findings weigh more than notices. The list below the grade shows every deduction individually.