DMARC Inspector
Fetch, parse and grade a domain's DMARC record — policy strength, reporting setup, alignment and external destination authorization.
DMARC is the policy layer on top of SPF and DKIM. Where those two standards authenticate mail, DMARC tells receivers what to do when authentication fails — and, crucially, sends you reports about everyone sending as your domain. A domain without DMARC has no say in what happens to forged mail carrying its name, and since 2024 the major mailbox providers require DMARC from bulk senders outright.
The single most important tag is the policy: p=none means "just report, deliver anyway" — the right starting point, but no protection; p=quarantine sends failing mail to spam; p=reject blocks it entirely and is the end goal. This inspector grades the policy, but also checks the details that quietly undermine it: a pct= below 100 leaves a percentage of forged mail unpoliced, sp=none exempts every subdomain from an otherwise strict policy, and a missing rua= tag means you receive no reports and are flying blind.
One detail almost every other checker skips: if your reports go to a different organization's domain (a monitoring service, for instance), that receiver must publish an authorization record at yourdomain._report._dmarc.their-domain. If it is missing, most receivers silently refuse to send reports there. We verify this for every external rua/ruf destination in your record.
If the domain has no DMARC record yet, do not copy one from a blog post — policies need to match your senders. Our DMARC Record Wizard asks a handful of questions and generates a correct record with step-by-step DNS instructions for common Danish providers.