Free DMARC checker
Is your domain spoofable?
Enter a domain to see its live DMARC record and whether mail that fails authentication is blocked, flagged, or delivered as if it were genuine.
Frequently asked
- What does "spoofable" mean?
- A domain is spoofable when mail claiming to be from it, but failing SPF/DKIM/DMARC authentication, can still reach an inbox looking legitimate. DMARC is the record that tells receiving mail servers what to do with mail that fails that authentication.
- What is the difference between none, quarantine, and reject?
- p=none only asks receivers to report on failing mail — nothing is blocked. p=quarantine asks receivers to send failing mail to spam. p=reject asks receivers to refuse it outright. Most domains work toward p=reject in stages.
- How do I fix this?
- Publish a DMARC TXT record at _dmarc.yourdomain.com with a rua= address you monitor, start at p=none to see what would be affected without blocking anything, then move to quarantine and reject once the reports look clean.