Free email security tool

Free DMARC Checker

Check the DMARC policy currently published for a domain. ScoutLab queries public DNS and explains the record without requiring an account, email address or access to the domain.

What this DMARC checker looks for

DMARC publishes a policy record in DNS at _dmarc.yourdomain. The checker reads that public TXT record and identifies the requested policy, testing mode, subdomain policy and aggregate-reporting destinations when present.

ScoutLab follows the current DMARC specification in RFC 9989. The older pct sampling tag is now historic; current DMARC uses the t=y testing flag for policy test mode.

Whether one DMARC1 policy record is published
The p=none, p=quarantine or p=reject policy
Whether RFC 9989 testing mode (t=y) is requested
Subdomain policy and aggregate reporting addresses where published
Historic tags such as pct, rf or ri that may still appear in older records

What a DNS record cannot prove

A published DMARC record is only one part of email authentication. Whether a particular message passes DMARC depends on SPF or DKIM authentication plus identifier alignment with the domain in the visible From address.

Use the result as a configuration check, not as a guarantee of deliverability or protection from phishing and account compromise.

Read a DMARC record example and choose the next step

Example TXT value at _dmarc.example.com.au: v=DMARC1; p=none. This is a monitoring policy; it does not ask receivers to quarantine or reject failing messages. Reporting needs additional configuration, so p=none alone does not deliver reports to you.

If no record is found, confirm the exact email domain and DNS record name with your mail provider. A lookup for a subdomain is not a complete test of organisational-domain policy discovery. Review DNS propagation and provider instructions before concluding that every message lacks DMARC protection.

Before moving to quarantine or reject, inventory legitimate senders and review authentication and alignment using real message headers and reports. Changing DNS without that check can affect legitimate mail. The broader free website security scan adds HTTPS, headers and DNS observations to this email-policy snapshot.

Check the rest of your public website security signals

This utility checks one email-authentication signal. ThreatScout's free website security scan also reviews HTTPS, security headers, DNS and the broader email-protection configuration.

Run the full free website security scan

Related email authentication guides

What is DMARC?Understand how DMARC validation and alignment work.

DMARC record guideRead the main tags and record structure.

DMARC policy guidanceUnderstand monitoring, testing and enforcement choices.

Frequently asked questions

Is this DMARC checker free?

Yes. Enter a domain and ScoutLab checks the public DMARC DNS record. No signup or payment details are required.

What does p=none mean?

p=none is a monitoring policy. It requests DMARC evaluation and can support reporting, but it does not request quarantine or reject handling for messages that fail DMARC.

What does t=y mean in DMARC?

RFC 9989 defines t=y as DMARC policy test mode. For quarantine or reject policies it asks participating receivers not to apply the full requested policy while the domain owner tests the configuration.

Does a DMARC record guarantee that spoofed email will be blocked?

No. DMARC is an important domain-authentication control, but message handling also depends on authentication results, alignment, receiver behaviour and other security controls.

Does DMARC work differently for Australian domains?

DMARC uses the same email-authentication standard for Australian domains, including .com.au. Query the domain used in the visible From address; local hosting does not change the requirement for SPF or DKIM authentication and alignment.