DMARC Record Checker Online — Verify DMARC Records Free
CodexFuse Team · 2026-10-28T15:14:35.345Z · 9 min read min read
Use a free DMARC record checker to verify your domain's DMARC policy, catch spoofing gaps, and stop fake emails sent in your name.
A DMARC record checker is a free online tool that looks up your domain's DMARC DNS record and explains, in plain language, what receiving mail servers will do with email that fails authentication. It answers one urgent question: can someone else send email pretending to be you, and will inboxes stop them?
If you run a business domain, that question matters more than most owners realise. Customers trust email from your domain. Attackers know it, and they exploit domains with missing or weak DMARC policies every day.
What Is a DMARC Record?
A DMARC record is a short piece of text published in your domain's DNS at the _dmarc subdomain. It tells receiving servers how to handle mail that claims to come from your domain but fails SPF or DKIM checks.
Think of SPF and DKIM as two ID checks at the door. SPF confirms the sending server is allowed to send for your domain. DKIM confirms the message was signed by an authorised sender and not altered in transit. DMARC is the rulebook that decides what happens when either check fails, and it asks receivers to send you reports about it.
A typical record looks like this: v=DMARC1; p=reject; rua=mailto:[email protected]. Each part has a job, and getting any part wrong quietly weakens the whole setup.
How Do I Check My DMARC Record?
You check your DMARC record by entering your domain into a DMARC record checker, which queries your domain's DNS for the TXT record at _dmarc, parses its tags, and reports your policy, alignment mode, and reporting addresses in readable form. The whole check takes seconds and needs no software installation.
CodexFuse's free DMARC record checker follows exactly the steps its tool page describes: enter your domain, run the check, and view the policy analysis. You get the raw record plus an explanation of what each tag means, so you are not left staring at a string of semicolons.
- Enter your domain: type the domain only, without https:// or www — for example,
yourdomain.com. - Run the check: the tool performs a DNS lookup for the TXT record at
_dmarc.yourdomain.com. - Read the policy: review the parsed result — the policy tag, subdomain policy, alignment settings, and reporting addresses — and fix anything marked missing or weak.
Check DMARC after every email change: a new newsletter platform, a new CRM, or a migrated mailbox can silently break alignment and push legitimate mail into spam.
What Does Each DMARC Tag Actually Mean?
DMARC tags look cryptic, but only a handful decide your protection level. The table below translates the ones a DMARC record checker will surface most often.
| Tag | What it controls | Safe starting point |
|---|---|---|
v=DMARC1 | Identifies the record as DMARC version 1 | Always required, always first |
p= | Policy for mail failing DMARC: none, quarantine, or reject | Start at none, move to reject once reports are clean |
sp= | Policy for subdomains, if different from the main domain | Match your main policy unless you have a reason not to |
adkim= / aspf= | How strictly DKIM and SPF domains must align (relaxed or strict) | Relaxed works for most setups; strict breaks some third-party senders |
pct= | Percentage of failing mail the policy applies to | 100 once you are confident; lower while testing |
rua= | Where aggregate reports go (daily summaries) | A dedicated mailbox you actually monitor |
ruf= | Where forensic reports go (individual failures) | Optional, and many receivers no longer send these |
The single most dangerous result is no record at all. Without DMARC, receivers have no instruction from you, so spoofed mail is judged on SPF and DKIM alone — and a message that passes neither can still land in an inbox.
Why Does a Missing DMARC Record Put Your Business at Risk?
A missing DMARC record leaves your domain open to exact-domain spoofing, which means attackers can send convincing fake invoices, password-reset emails, and supplier payment requests that appear to come from you. Your customers cannot tell the difference, and neither can their mail filters.
The damage is rarely just technical. A DKIM record check confirms your signing is in place, while DMARC decides what happens when either check fails. One without the other is half a lock.
Worked Example: A Dental Clinic Discovers Its Domain Is Unprotected
Fictional scenario, realistic numbers. BrightSmile Dental is a three-dentist clinic in Lahore sending roughly 400 emails a month: appointment reminders, lab orders, and invoices. The practice manager hears from two patients in one week about suspicious "payment reminder" emails that look exactly like the clinic's own invoices.
She runs the clinic's domain through a DMARC record checker and gets a blunt result: no DMARC record found. The clinic does have SPF and DKIM, but without DMARC there is no published instruction telling receivers to reject mail that fails both checks.
Her fix follows a careful sequence:
- Publish a monitoring policy first:
v=DMARC1; p=none; rua=mailto:[email protected]— this collects reports without touching legitimate mail. - Read two weeks of aggregate reports: the reports show the clinic's booking system sends from a subdomain that fails SPF, while everything else aligns. She adds that sender to SPF.
- Tighten in stages:
p=quarantine; pct=50for a week, thenpct=100, and only thenp=rejectonce the reports show zero legitimate failures. - Re-check and schedule a monthly check: the final DMARC record checker result shows
p=rejectwith reporting intact, and the fake invoices stop reaching patients.
The whole project takes under an hour of active work spread over three weeks. The staged approach is the point: jumping straight to p=reject before reading reports is how businesses accidentally block their own booking confirmations.
Never move to p=reject on day one. Start at p=none, read your aggregate reports, fix every legitimate sender that fails alignment, and only then tighten the policy.
What Should You Do After the Check?
A check is only useful if it changes something. Treat the result as a short work list, in this order.
- No record found: publish a monitoring record (
p=none) with a reporting address today, then plan the staged tightening above. - Policy is p=none: you are collecting data, not protection. Review reports weekly and set a date to move to quarantine.
- Policy is p=quarantine: good progress — failing mail goes to spam instead of the inbox. Confirm no legitimate mail is affected, then plan the move to reject.
- Policy is p=reject: full protection. Keep the reporting address monitored so a future sender change does not silently break alignment.
- Record has syntax errors: fix the record at your DNS provider and re-run the check — a malformed record is treated as no record by many receivers.
If your DMARC check came back empty or stuck at p=none, CodexFuse can sort your email authentication end to end — DMARC, SPF, and DKIM set up and monitored on your managed business email, on credits, with no server babysitting.
Get Started with CodexFuseWhat a DMARC Record Checker Does Not Do
Honest limits matter here, because a clean DMARC result can breed false confidence. A DMARC record checker only inspects your published DNS record. It cannot see mail that never reaches a receiver, cannot confirm that your reports mailbox is actually read, and cannot protect lookalike domains — an attacker registering a near-identical domain is a separate problem that needs brand monitoring, not DNS.
DMARC also does not authenticate the content of a message, does not scan attachments, and does nothing for mail sent from a domain you do not own. If your team clicks phishing links in mail from other domains, that is a training and filtering problem. For the wider picture, pair DMARC with a disposable email check on signups and a review of your site's other headers, such as a strict content security policy, so one weak layer does not undo the rest.
If spoofed mail is already reaching your customers, read the e-commerce brand owner's emergency guide to email deliverability next — it covers the wider deliverability fixes that sit alongside DMARC.
How Does CodexFuse Handle Email Authentication for You?
On CodexFuse, business email is part of the managed platform, not a DIY DNS project. The concrete workflow looks like this: you bring your domain or register one on the platform, add your mailboxes, and the platform publishes and maintains the SPF, DKIM, and DMARC records for your domain. When you add a new sending service — a newsletter tool, a CRM, a booking system — you add it once as an authorised sender instead of editing raw DNS records and hoping you got the syntax right.
The decision rule is simple: if email is how your business takes orders, sends invoices, or talks to patients and clients, DMARC is not optional — and managing it by hand across every sender is exactly the kind of server babysitting the managed platform exists to remove. Run the free DMARC record checker first, see where you stand, and then let the platform hold that position for you.
Frequently Asked Questions
What is a DMARC record checker?
A DMARC record checker is a free tool that queries the DNS TXT record at _dmarc for your domain and explains your DMARC policy in plain language, including the policy tag, alignment mode, and reporting addresses.
Is the CodexFuse DMARC record checker free?
Yes. You enter your domain, run the check, and view the policy analysis at no cost, with no software to install and no account needed for the check itself.
What does p=none mean?
The p=none policy means receivers take no special action on mail that fails DMARC, but still send you aggregate reports. It is a monitoring mode, not protection, and it is the safe starting point before tightening to quarantine or reject.
How long does DMARC take to work?
The record itself typically propagates within minutes to a few hours after you publish it, depending on your DNS TTL. The full journey from monitoring to a reject policy usually takes two to four weeks, because you need enough report data to confirm legitimate senders align.
Do I need SPF and DKIM for DMARC to work?
Yes. DMARC builds on SPF and DKIM: at least one of them must pass and align with your domain for a message to pass DMARC. Without either, DMARC has nothing to build on.
Can DMARC stop all email spoofing?
No. DMARC stops exact-domain spoofing for domains that publish a reject policy, but it cannot stop lookalike domains, compromised accounts, or phishing sent from domains you do not control. Treat it as one strong layer, not a complete shield.
Check Your Domain Now, Then Lock It Down
Run your domain through the free DMARC record checker today. If there is no record, publish a monitoring policy this week. If you are stuck at p=none, read your reports and set a date to tighten. And if you would rather have email authentication handled for you — records published, senders aligned, failures traced — move your business email to CodexFuse and let the managed platform hold the line while you run your business.