DMARC Record Checker

Inspect the authoritative DMARC TXT record, validate current and historic tags, understand policy inheritance, and verify external report authorization without claiming that a DNS record proves message-level DMARC pass.

Live authoritative evidence
Offline pasted-record analysis
RFC 9989 diagnostics
External RUA/RUF authorization

Domain, email address, or URL

Required for live DNS; optional for offline syntax analysis. Unicode names are converted to DNS A-labels. IP addresses are rejected.

Pasted DMARC record (offline)

Paste a value, a quoted split TXT value, or one complete DMARC record per line. Offline analysis performs no DNS lookup.

Organizational-domain and resolver options

Organizational domain (optional, user-supplied)

If the exact domain has no single usable policy, one bounded lookup is made here. This does not perform the full RFC 9989 DNS tree walk or guess a public suffix.

Discovery resolver

Used by the same-origin analyzer for delegation discovery and resolver DNSSEC claims. TXT evidence is requested directly from authoritative endpoints.

A domain lookup can evaluate publication and policy syntax. It cannot prove that a particular message passes: that requires actual SPF/DKIM results plus alignment with the message’s visible From domain.

Evidence

DMARC analysis

Evidence source—

Policy request—

Reporting URIs—

DNS / syntax state—

Severity-ranked findings

Every item separates observed evidence from the action it supports. Colors are supplemented by text labels.

Policy and tag interpretation

Defaults and inheritance are shown explicitly. Historic tags are parsed for migration guidance but not treated as current controls.

DMARC tags, published values, effective values, and explanations
Tag	Published value	Interpretation / default	Status

Aggregate and failure report destinations

Potentially external destinations can be checked at the RFC authorization owner. Organizational-domain equality cannot be inferred from the last two labels.

DMARC reporting URIs and external authorization evidence
Tag	Destination	Format / size	Scope	Authorization evidence

DNS evidence

RCODE, authoritative endpoint, TTL, response time, and answer-set splits are shown without converting missing or partial evidence into a stronger conclusion.

Authoritative DNS observations for DMARC lookups
Lookup	Nameserver	Endpoint	RCODE / outcome	TTL	DNS time	TXT values

Remediation and rollout checklist

Move toward enforcement only after aggregate evidence shows every legitimate stream authenticates and aligns.

Simulated message alignment

Optional explainer only. Enter actual authentication results and identifiers from one message; no message is sent or inspected.

Visible From domain

SPF-authenticated identifier SPF result

DKIM signing domain (d=) DKIM result

Supply message identifiers and authentication results to run the simulation.

Raw evidence and method limits

Raw record and bounded evidence

How policy inheritance is handled here

RFC 9989 policy discovery may walk up to eight DNS names and can use psd=y or psd=n to establish the organizational boundary. This page deliberately queries the exact author domain and, only when you supply it, one organizational-domain fallback. It does not guess a registrable domain from label count, download a Public Suffix List, or claim to have completed the receiver’s full tree walk.

For inherited policy, sp applies to existing subdomains and np applies to non-existent subdomains; each falls back through the chain described in the tag table. A query for _dmarc.example does not establish whether example itself exists, so this checker does not choose between sp and np.

Standards and terminology

RFC 9989 defines current DMARC policy, alignment, tree-walk discovery, and active tags.
RFC 9990 defines aggregate reporting and external destination authorization.
RFC 9991 defines failure reporting and its privacy considerations.
IANA DMARC parameters identifies active and historic tags. RFC 9989 obsoletes RFC 7489.