Free tool
Read a domain's DMARC policy, the policy a subdomain inherits, and the one thing almost no checker looks at: whether the domain receiving your aggregate reports has authorised itself to receive them.
SPF and DKIM each answer a question and neither decides anything. DMARC is the record that binds them to the domain a reader actually sees — the one in the From header — and tells receivers what to do when neither aligns. It also asks them to send you a daily summary of every message claiming to be from your domain, which is the only view anybody has of their own forgery problem.
p — the policy: none, quarantine or reject. Everything else is a detail. rua — where the aggregate reports go. Without it the policy still works and you are blind. sp — the policy for subdomains. sp=none under an enforcing p leaves every subdomain forgeable, which is where forgery goes once the apex is protected. pct — the share of failing mail the policy applies to. Useful while ramping, and easy to leave at a value that quietly exempts most of your traffic. adkim / aspf — relaxed or strict alignment. The version tag is not first.p=reject; v=DMARC1 is discarded by every receiver that follows the specification. It looks completely correct in a zone file.
There are two records. Receivers do not pick one; they ignore both, and the domain is exactly as exposed as if it had none.
It is published at the apex. A DMARC record belongs at _dmarc.yourdomain. At the domain itself it is just another TXT record nobody reads.
Nothing to the mail. It asks receivers to report on what they saw and to deliver everything as they would have anyway. It is the correct place to start — you need a fortnight of reports before you know what would break — and it is where most domains stop, still forgeable.
Publish an rua= address and read the reports until every legitimate sender appears with SPF or DKIM aligned. Then p=quarantine, optionally with pct= to ramp it. Then p=reject. The step that catches people is a service nobody remembered — a ticketing system, a payroll tool — which shows up in the reports long before it shows up as a complaint.
Either there is no rua= tag, or the address is on a different domain that has not published the authorisation record. RFC 7489 requires the receiving domain to publish a TXT record at <your-domain>._report._dmarc.<their-domain>; without it, receivers that follow the rule send nothing. This checker tests exactly that.
DMARC does not just ask whether SPF or DKIM passed — it asks whether the domain that passed is the domain in the From header. Relaxed alignment (the default) accepts a subdomain; strict requires an exact match. A message can pass SPF for the sending platform's own domain and still fail DMARC, which is the single most common surprise.
No. A subdomain with no record of its own inherits the organizational domain's policy, or its sp= tag if there is one. This checker reports which name the applicable record was actually found at, so you know where the fix goes.