Skip to content
PixelPrivate
Log inFree trial
Menu
Attack Surface & ExposureEmail & Brand ProtectionData ExposureTrust & CompliancePolicy & AccessPlatform overviewCEOs of growing companiesCFOs and finance leadersManufacturingSaaSE-commerceHealthcare and clinicsProfessional servicesAgencies and MSPsCyber-insurance readinessReal casesScenariosFree toolsLearnPricingLog inStart 14-day free trial

Free tool

DMARC checker

DMARC tells receiving mail servers what to do with email that claims to be from your domain but fails authentication. This checker finds your record at _dmarc, validates its tags and explains your policy in plain language.

No credit card. Only scan domains you own or are authorized to assess. PixelPrivate performs passive, public checks only.

What this checks

  • Record exists at _dmarc.yourdomain and there is exactly one
  • p= policy: none (monitor), quarantine (spam), reject (refuse), explained in plain language
  • sp= subdomain policy weaker than p=
  • pct= rollout percentage
  • rua= and ruf= addresses, and whether outside report addresses have authorised them
  • adkim/aspf alignment, fo=, ri= and rf= tags

How to use it

  1. Enter your domain.
  2. If no record exists, copy the suggested p=none record and add it as a TXT record at _dmarc.
  3. Read aggregate reports for a few weeks and fix any legitimate sender that fails.
  4. Move to quarantine with a small pct and raise it gradually. Reject comes last, never first.

Methodology and limitations

PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.

Key terms

  • DMARC — DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks..
  • SPF — SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email on behalf of your domain..
  • DKIM — DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing email so receivers can verify it came from your domain and was not altered in transit..

Frequently asked questions

What is the difference between p=none, quarantine and reject?

none only monitors, quarantine asks receivers to treat failures as suspicious (usually spam), reject asks receivers to refuse failing mail.

Where do I add the DMARC record?

In the DNS settings of whoever hosts your DNS (often your registrar or Cloudflare), as a TXT record with the name _dmarc.

Who receives the reports?

The mailbox in rua=. Reports are XML and hard to read; a free DMARC report service can summarise them.

Monitor this domain continuously with PixelPrivate.

Create a free account to re-check automatically, keep your DKIM selectors, and get alerted when SPF, DKIM, DMARC or MX records change.

Create free account

Related tools

Related guides