DMARC checker

Read your domain's DMARC policy, alignment, and reporting addresses.

Create a free SJ Monitor account to watch your domains' uptime, SSL, and blacklist status around the clock. Start free →

This DMARC checker reads the DMARC lookup record published at _dmarc.yourdomain.com and breaks down each tag so you can see your policy at a glance. It tells you whether you are on p=none, quarantine, or reject, where aggregate and forensic reports are sent, and whether alignment is set strictly or relaxed. A weak or missing policy means attackers can more easily spoof your domain, so reading the record correctly matters for deliverability and brand protection. Once the record is right, SJ Monitor can keep watching it so an accidental edit never goes unnoticed.

Frequently asked questions

What does p=none mean?

The p=none policy only monitors and reports; it does not block spoofed mail. It is a safe starting point, but you should move toward quarantine or reject once your reports look clean.

Why did my DMARC record stop working?

Common causes are a typo during a DNS edit, a removed _dmarc entry, or a record split incorrectly across TXT values. SJ Monitor's continuous DNS and email record monitoring catches these changes and alerts you before they hurt delivery.

Can I check multiple domains at once?

The free tool checks one domain per lookup, while a paid plan adds bulk and CSV input for checking many domains together.

What's the difference between p, sp, and pct?

The p tag sets the policy for the domain, sp overrides it for subdomains, and pct tells receivers what percentage of failing mail to apply the policy to. A pct under 100 is useful for a gradual rollout to reject.

What's the difference between strict and relaxed alignment?

Relaxed (the default) lets the authenticated domain be a subdomain of the From domain, while strict requires an exact match. The aspf and adkim tags control SPF and DKIM alignment respectively.

Where should the DMARC record live?

Always at _dmarc.yourdomain.com as a TXT record, not on the bare domain. A common mistake is publishing the DMARC value on the apex, where receivers won't look for it.

Share this tool: X LinkedIn Facebook Reddit Email

We use essential cookies to run SJ Monitor (sign-in, security). See our privacy policy.