# Free DMARC Record Checker & Policy Tool

> Free DMARC record checker and policy analyzer. Validate p=reject and p=quarantine policies, verify SPF/DKIM alignment, and inspect RUA aggregate reporting.

DMARC publishes a policy telling receivers how to treat failures, and requires alignment: the domain that passed SPF or DKIM must match the From domain your recipient sees. This is why mail can pass SPF and still fail DMARC.

## Checks Performed
- The record exists at _dmarc and parses
- The policy (p=) is present and its effect is explained
- A reporting address (rua=) is set, so the policy is observable
- The percentage (pct=) and subdomain policy are sensible

## Sample Verification (_dmarc.example.com)
Valid but effectively blind — add a reporting address before tightening the policy.

| Check | Verdict | Details |
| --- | --- | --- |
| Record found | PASS | v=DMARC1; p=none; pct=100 |
| Policy | WARN | p=none — monitor only |
| Reporting address | FAIL | missing |
| Coverage | PASS | pct=100 |

## Frequently Asked Questions
### What does p=none actually do?

Nothing to your mail. It asks receivers to report on authentication results without changing delivery. It is the correct first stage: publish it, read the aggregate reports for a few weeks, and find the legitimate senders you had forgotten about before enforcing anything.

### What is DMARC alignment?

Alignment requires that the domain which passed SPF or DKIM matches the domain in the visible From header. If your provider uses its own bounce domain as the envelope sender, SPF passes for that domain rather than yours and alignment fails. A custom return-path on your own domain fixes it.

### How do I move to p=reject safely?

In stages. Start at p=none and read reports. Move to p=quarantine with a low pct= and raise it gradually. Only go to p=reject once reports show no legitimate mail failing.