Enter your domain. We check its DMARC and SPF records in public DNS, score your setup, and explain what to fix first, in plain English.
p=quarantinePolicy: QuarantineQuarantinerua=mailto:tay5up7hhr…tyourinbox.comReports: onAggregate reports go to one address.Onsp= not setSubdomains: inherit QuarantineInheritsTwo records from public DNS, and a third we name but do not score.
_dmarc.yourdomain.comPolicy strength, alignment mode, reporting addresses, and subdomain coverage. We also read the record against DMARCbis, the May 2026 standard.
yourdomain.comEvery include is followed and counted against the limit of 10 DNS lookups, and the catch-all at the end of the record is read.
selector._domainkey.yourdomain.comSigned messages name their selector in the DKIM-Signature header. Common selectors can be checked, but a DNS check cannot prove your messages are signed. Check published keys with the DKIM verifier.
What the score and the words on this page mean.
An enforcing policy (Quarantine or Reject) with a reporting address and a healthy SPF record scores 100. Each finding takes points off: a missing DMARC record costs the most, then a missing reporting address, then SPF problems. 90 and above reads Strong, 70 to 89 Decent, 40 to 69 Needs work, below 40 Weak. With no DMARC and no SPF record there is nothing to score.
They are the three DMARC policies, written as p=none, p=quarantine and p=reject in the record. Monitoring asks receivers for reports and no action. Quarantine asks them to treat failing mail as suspicious. Reject asks them to refuse it. Receiver local policy still applies.
DKIM keys live at selector._domainkey.yourdomain.com. Signed messages name the selector in their DKIM-Signature header, and known selectors can be checked in DNS. A domain lookup cannot list every selector or prove that your messages are signed, so DKIM is not included in this score.
RFC 9989, the May 2026 DMARC standard. It kept v=DMARC1, removed pct, and added t (test mode), np (a policy for subdomains that do not exist) and psd. Existing records keep working. What changed in DMARCbis.
No. This is a point-in-time read of two DNS records. Monitoring reads the DMARC reports receivers send about your domain every day, so you see who is sending as you and whether their mail passes.
Ten an hour from one network. The limit keeps the tool fast for everyone.
The reading behind each finding, and the checks this page leaves to a sibling tool.