DMARC Checker
Policy telling mail receivers what to do with mail that fails SPF/DKIM.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: RFC 9989 — Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
About this validation
Checks a domain's DMARC policy for handling mail that fails SPF/DKIM.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live DNS TXT-record lookup performed by SEOTechTests for a _dmarc policy record. Standard: RFC 9989 (May 2026) is the current core DMARC specification, obsoleting the original RFC 7489 -- existing v=DMARC1 records remain valid and this check's record format hasn't changed.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What does a DMARC policy do?
It tells receiving mail servers what to do with email that fails both SPF and DKIM alignment for this domain -- monitor only, quarantine (spam folder), or reject outright -- and where to send reports about it.
Why is DMARC important for domain security/reputation?
Without a DMARC policy, mail servers have no domain-specified instruction for handling spoofed mail that fails SPF/DKIM, which makes convincing phishing impersonating this domain easier to deliver.
Why does this check now cite RFC 9989 instead of RFC 7489?
RFC 7489 was obsoleted in May 2026 by RFC 9989 (core protocol), 9990 (aggregate reporting), and 9991 (failure reporting), moving DMARC onto the IETF Standards Track. Records still start with v=DMARC1 -- nothing about existing deployments changed.
Does having a DMARC record mean a domain's email can't be spoofed?
No. It reduces the chance that spoofed mail reaches inboxes at receivers who enforce the policy, but enforcement depends on the receiving mail server, and a policy set to "monitor only" (p=none) takes no protective action at all.