MailAuthWatch

DMARC record checker

Validate a domain's DMARC policy, reporting addresses, percentage and alignment, including whether external report receivers have authorised your domain.

Free, instant, no signup. Results include SPF, DKIM and DMARC together.

What the DMARC check validates

DMARC (RFC 7489) is a TXT record at _dmarc.yourdomain.com. It tells receivers what to do when a message fails both SPF and DKIM alignment, and where to send reports. The checker verifies the v= and p= tags, flags p=none, partial pct=, a weaker subdomain policy, missing rua=, and for every external report address it looks up the <yourdomain>._report._dmarc.<reportdomain> authorisation record that receivers require before they will send reports there.

Google and Yahoo sender requirements

Since February 2024, anyone sending more than 5,000 messages a day to Gmail or Yahoo must publish a DMARC record (at least p=none), pass SPF and DKIM, and align with the From domain. Domains that do not comply see mail rejected or spam-foldered.

Ways out of a bad result

Remove what you stopped using. Most records over the limit include a tool that was cancelled years ago.
Flatten the noisy ones. Swap a heavy include for its IP ranges, and monitor them.
Use subdomains. Send marketing from a subdomain with its own SPF and stop crowding the root.
Monitoring re-counts this every day, so the next include someone adds does not sneak past 10.

Recently graded

Public checks from the last few days. Every report is re-measured from DNS when opened.

live
DomainSPFDKIMDMARCGrade
gandi.net2 lookupsnot foundp=noneCzoom.us6 lookups2048-bitp=rejectAskype.com2 lookupsnot foundp=rejectBshopify.com4 lookups2048-bitp=rejectAbing.com1 lookupsnot foundp=rejectBebay.com10 lookups2048-bitp=rejectAfacebook.com1 lookupsnot foundp=rejectBmsn.com7 lookups2048-bitp=noneB