DMARC checker — free DMARC lookup, SPF & DKIM record checker
Check whether your domain's email is protected from spoofing and phishing. This DMARC lookup tool reads your domain's live SPF, DMARC record, and DKIM DNS records — free, instant, no signup.
This checks email authentication only. M365 Health Score scores your entire Microsoft 365 tenant — Secure Score, identity risk, data exposure, email auth, and license waste.
Run a full free scanCommon questions
What is DMARC and why does it matter?
DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do with email that fails SPF and DKIM checks — reject it, quarantine it, or let it through. Without a DMARC policy, attackers can spoof your domain in phishing emails sent to your customers and partners, and you won't even be notified.
What's the difference between a DMARC lookup and a DMARC record checker?
They're the same thing in practice — both terms describe a tool that queries DNS for your domain's _dmarc TXT record and reports whether it exists, what policy it specifies, and whether your SPF and DKIM records back it up. This tool does a live DMARC lookup against your domain every time you run a check.
Why doesn't Microsoft 365 set this up automatically?
Microsoft 365 publishes a default SPF include, but DMARC and a hardened SPF record require you to manually add TXT records to your domain's DNS — usually at your domain registrar or DNS host, not inside the Microsoft 365 admin center. This is one of the most commonly skipped security steps for small businesses.
What's a safe DMARC policy to start with?
Start with p=none to monitor without affecting delivery, review the reports for a few weeks, then move to p=quarantine and eventually p=reject once you've confirmed all your legitimate sending sources (Microsoft 365, marketing tools, CRM, etc.) are passing authentication.
Does a missing DKIM result here mean DKIM isn't set up?
Not necessarily. This tool only checks common default selectors. Many providers — including Microsoft 365 — use custom or rotating selectors that a generic check can't discover. A clean SPF and DMARC result with no DKIM detected isn't a reliable failure signal; the full M365 Health Score scan checks your tenant's actual configuration directly via Graph API.