Domain Health
Log inGet started

Free DMARC checker

See whether your domain has a DMARC record, how strict it is, and whether someone could send email that looks like it came from you. Results in seconds, in plain English.

Free, no account needed. Checks SPF, DKIM and DMARC together.

What DMARC does

DMARC is the postmark on your email. It's a short DNS record that tells Gmail, Outlook and every other receiving server what to do with mail that claims to be from your domain but fails the SPF and DKIM checks. It also asks those servers to send you reports, so you can see who is sending as you.

A typical record lives at _dmarc.yourdomain.co.za and looks like this:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.co.za

What the checker looks at

  • Whether a DMARC record exists at all, and whether there's exactly one.
  • The policy: p=none (monitor only), p=quarantine (send failures to spam) or p=reject (refuse them).
  • Whether the policy only applies to part of your mail through a pct value below 100.
  • Your SPF and DKIM at the same time, because DMARC depends on both.

How South African businesses are doing

In October 2026 we checked 621 South African business domains that receive email, from JSE-listed companies to Stellenbosch wine farms and Cape Town tourism businesses. A third had no DMARC record at all, and another 38% had one set to p=none, which protects nothing. Only 29% were actually telling mail servers to stop forged email.

How to get to p=reject safely

  1. Publish v=DMARC1; p=none; rua=mailto:you@yourdomain.co.za and let reports arrive for two to four weeks.
  2. Make sure every service that sends as you (Microsoft 365, Google Workspace, your accounting package, your newsletter tool) passes SPF or DKIM.
  3. Change the policy to p=quarantine and watch for complaints.
  4. When nothing legitimate is being caught, move to p=reject.

Using Microsoft 365?

The Microsoft 365 admin center can show a green Check health screen even when DMARC is missing. Our Microsoft 365 DMARC guide walks through SPF, DKIM and DMARC for a 365 tenant step by step.

Common questions

Do I really need DMARC for a small business?

Yes. Since 2024 Gmail and Yahoo require DMARC from anyone sending in bulk to their users, Outlook.com followed in 2025, and every major provider uses it to decide whether mail that claims to be from you is genuine. Without it, anyone can send invoices and payment-change requests that look like they came from your domain.

What's the difference between p=none, p=quarantine and p=reject?

p=none only asks for reports and changes nothing, so forged mail still gets delivered. p=quarantine tells receiving servers to put mail that fails SPF and DKIM into spam. p=reject tells them to refuse it outright. Quarantine or reject is what actually protects you.

Will moving to p=reject stop my own email arriving?

Only if a service that sends as your domain isn't covered by SPF or signing with DKIM. That's why you start at p=none with reports, fix every legitimate sender you find, then tighten to quarantine and finally reject.

Does the check change anything on my domain?

No. It only reads public DNS records, the same ones any mail server can see. Nothing is changed and no mailbox is accessed.