A DMARC checker that is actually free
No account, no trial, no report held back behind an email address. Here is what it checks and what makes a DMARC check wrong.
Most free DMARC checkers are free in the sense that the first hit is free. This one does not ask for an address, and nothing about a checkup is stored.
What it checks
The policy receivers actually apply, which is not always the record at your domain. If yours has no DMARC record, receivers walk up the DNS tree and apply a parent’s policy. The checker reports the effective policy and names where it came from.
Test mode. The t=y tag makes receivers apply p=none regardless of what your policy says. A record reading p=reject; t=y protects nothing, and it is the single most common reason somebody is certain they are protected when they are not.
Alignment. Whether SPF or DKIM can actually align with your From domain, which is the condition that decides whether your policy ever passes.
Reporting. Whether your rua addresses will receive anything. A reporting address at a different domain needs that domain to authorise it with its own record, and without it receivers drop every report silently.
Obsolete tags. pct, rf and ri were removed in RFC 9989. Receivers ignore them, so a staged rollout built on pct is not happening.
The blunt version
If you want one answer rather than a chart, the spoofability test says whether somebody can send as you right now, and nothing else.
Reading your reports
Publishing DMARC gives you daily XML reports that are unreadable by eye. Bloodwork parses them in your browser, which means the file never leaves your machine, and shows you every source sending as your domain and whether it aligned.
Start
Check a DMARC record, or run the full checkup to see DMARC in context with everything it depends on.
Common questions
Why do most free DMARC checkers ask for an email address?
Because the check is the lead magnet rather than the product. The DNS lookup behind it costs a fraction of a penny; the address is the thing being collected. This one does not ask, and stores nothing about a checkup.
What makes a DMARC check wrong?
Three things, in order. Reading the record at the domain and missing that it is inherited from a parent. Ignoring the t tag, which overrides the policy entirely. And reporting a policy as protective when alignment means nothing can pass it.
Can I check a domain I do not own?
Yes. DMARC records are public DNS, published so that any receiver in the world can read them. Checking one is the same query a mail server makes on every message.
Run the test on your own domain
Read next
DMARC, from a first record to enforcement
GuideThe only record that governs the address your recipient actually sees. What it does, what it does not, and how to reach enforcement without breaking your own mail.
What is DMARC?
The only email record that looks at the address your recipient actually sees, and the only one that stops somebody sending in your name.
p=none, quarantine or reject?
Three policies, one of which protects nothing. What each does to your mail and how to move between them without breaking anything.
Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.