DMARC check

Finds the DMARC record for the domain or its organisational domain, validates the tags and explains policy, subdomain policy, alignment and reporting addresses.

Updated 2026-10-07

What this tool checks

The DMARC check queries _dmarc.DOMAIN, where DOMAIN is the domain you give. If the name has no record, it queries the organisational domain, determined with the Public Suffix List (RFC 7489 section 3.2).

It validates the tags and reports syntax errors and unknown tags.
It explains the policy p, the subdomain policy sp and the percentage pct.
It reports the effective policy. If p is invalid but a valid rua is present, the policy is treated as none, as the RFC describes.
It lists report addresses and notes the ones that are not mailto: addresses, because they are not supported.
It flags p=none, a partial percentage with an enforcing policy, a missing rua, and multiple records.

How to read the result

The result separates what is published from what applies. If the record comes from the organisational domain, the result says so. A finding is information about the record, not a judgement of your mail setup.

Limitations

The check reads the published record only. It does not look at DMARC reports or at how your mail actually authenticates.
Alignment settings are explained, but whether your mail aligns depends on SPF and DKIM for each message.
Reports sent to other domains may need an authorisation record at that domain. The check does not test that.

Use it from code

API reference for DMARC check

curl -i "https://api.probekit.dev/v1/mail/dmarc?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.01 per check

Findings this tool can report

DMARC (10)

Info DMARC_INHERITED The DMARC policy comes from the organisational domain.
Error DMARC_INVALID_POLICY The DMARC record has a missing or invalid p tag.
Error DMARC_MULTIPLE_RECORDS More than one DMARC record was found.
Warning DMARC_NOT_FOUND No DMARC record was found for the domain or its organisational domain.
Info DMARC_NO_RUA The DMARC record has no aggregate report address (rua).
Info DMARC_PARTIAL_PCT The DMARC policy applies to only part of the failing mail (pct below 100).
Info DMARC_POLICY_NONE The DMARC policy is p=none (monitoring only).
Error DMARC_SYNTAX_ERROR The DMARC record contains a tag that cannot be parsed or has an invalid value.
Info DMARC_UNKNOWN_TAG The DMARC record contains tags that are not defined.
Info DMARC_UNSUPPORTED_REPORT_URI A DMARC report address uses a scheme other than mailto.

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (2)

Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Frequently asked questions

What does p=none do?

A none policy asks receivers not to take action on mail that fails DMARC. It is used to collect reports before moving to quarantine or reject. The check flags it so that it is a conscious choice and not a leftover.

Why does my subdomain show the parent's policy?

When a subdomain has no DMARC record of its own, receivers use the record of the organisational domain (RFC 7489 section 3.2). The check does the same and reports that the policy is inherited. If the parent record has an sp tag, that policy applies to subdomains.

How does the check find the organisational domain?

It uses the Public Suffix List, the same list receivers rely on, to decide which part of the name is the registered domain.

Does a reporting address mean I will receive reports?

The rua tag only says where aggregate reports should be sent. Whether a receiver sends them is up to the receiver. The check reports that rua is missing or uses an unsupported address type.