DMARC Checker pulls the TXT record at `_dmarc.<domain>`, parses every tag (`p`, `sp`, `pct`, `rua`, `ruf`, `adkim`, `aspf`, `fo`, `rf`, `ri`), validates syntax against RFC 7489, and returns an A–F letter grade computed from the *effective* enforcement (policy × pct/100 — not just the tag value). Includes cross-domain `_report._dmarc` authorization check, bulk-sender compliance chips for Google/Yahoo 2024 and Microsoft 2025, BIMI eligibility, a six-step rollout stepper synced to your live state, and a plain-English AI diagnosis with copy-paste TXT fix snippets. Tells you not just whether DMARC is present, but exactly what to publish next.
Five tabs, seven independent classes of output per DMARC check. The A–F grade + effective-enforcement math and the cross-domain reporter authorization check are the differentiators most other tools don't do.
Effective enforcement = policyScore × (pct/100). `p=reject; pct=100` scores 2.0 (grade A). `p=reject; pct=10` scores only 0.2 (grade C — a partial rollout most tools miss). The badge is a colour-coded ring around the letter — fills proportionally to the score.
Every check gets a 2–3 sentence summary in plain English, severity-tagged findings (critical / warning / info), and 3–5 imperative bullet recommendations. Not generic DMARC theory — tied specifically to what your record actually says right now.
For each critical or warning finding, the AI emits a copy-pasteable TXT record showing the corrected DMARC record, plus a `dig` command to verify after you publish. Terminal-styled cards with one-tap copy. Skip the trial-and-error editing.
When your `rua=` points to a mailbox on a different domain, RFC requires the reporter to publish `<yourdomain>._report._dmarc.<reporter>` — otherwise reports are silently dropped. We check this for every external URI and surface unauthorized reporters as a warning.
Instant green/grey pills for Google/Yahoo 2024 (Feb 2024 bulk-sender rules), Microsoft 2025 (aligned May 2025), and BIMI eligibility. `p=none` clears the bulk-sender floor; only `p=quarantine`/`reject` at `pct=100` unlocks BIMI.
Interactive ladder from `p=none` to `p=reject; pct=100`. The step matching your current policy + pct + rua state gets a 'You are here' pill, and the next-step TXT snippet renders inline — ready to publish.
Eleven RFC-based checks grouped by high/medium/low severity — including single-record enforcement (RFC 7489 forbids multiples), pct rollout, external reporter authorization, alignment strictness, and subdomain policy. Pass rate + gradient progress bar at the top.
Full tag table with three columns: current value, plain-English meaning, and RFC default. Custom values highlighted in blue, defaults muted grey — instantly spot what's non-standard. Reporting destinations rendered with the cross-domain auth badge inline.
SPF and DKIM each answer one narrow question. DMARC is what tells receivers what to do with the answer — and what to report back to you. Without DMARC, you have authentication but no enforcement and no visibility. Five reasons it matters in 2026:
A DMARC check is a TXT query, a structural parse, a few outbound checks, a grade computation, and an AI review. We follow the same algorithm a receiving mail server would when deciding whether and how to apply policy to inbound mail — and then add the layer that turns raw data into action.
Grade is a function of policy strength, pct rollout, and whether aggregate reporting is configured. Same signals a receiver uses to decide enforcement — packaged as a single letter you can put on a status board.
Three terms, three layers. DMARC sits on top of SPF and DKIM and makes the enforcement decision. The shortest framing: SPF authorizes IPs, DKIM signs messages, DMARC sets policy.
A DMARC record is a sequence of `tag=value` pairs separated by semicolons. Only `v=DMARC1` and `p=` are required; everything else is optional with sensible defaults. The Record & Tags tab shows current-vs-default side by side — non-default values in blue, defaults muted.
Moving from `p=none` to `p=reject` is the entire point of DMARC — and the single most common place teams get stuck. The Rollout tab renders these six steps as an interactive ladder that highlights your current position and shows the next TXT record to publish. Copy of the six steps below matches the tool exactly.
Every field — parsed record, policy scoring, cross-domain authorization, compliance flags, tests, AI diagnosis, fix snippets — is available as JSON. Useful for DMARC-rollout monitoring, vendor onboarding, M&A diligence, and continuous policy enforcement.
curl 'https://api.domainscan.in/v1/domain/dmarc?domain=microsoft.com&tests=true'const res = await fetch(
'https://api.domainscan.in/v1/domain/dmarc?domain=microsoft.com&tests=true'
);
const {data} = await res.json();
console.log(data.dmarc); // raw DMARC TXT
console.log(data.score.grade); // 'A' | 'B' | 'C' | 'D' | 'F'
console.log(data.score.effectiveEnforcement); // 0.0 – 2.0
console.log(data.compliance.bimiEligible); // boolean
console.log(data.compliance.googleYahoo2024); // boolean
// Cross-domain reporter authorization
data.reporting.rua.forEach(r => {
if (!r.authorized) {
console.warn(`Unauthorized reporter: ${r.uri} (${r.reason})`);
}
});
// Copy-paste fixes (AI-generated)
(data.AiAnalysis?.fixes || []).forEach(fix => {
console.log(`Fix: ${fix.issue}`);
console.log(fix.snippet);
});
// Failing tests grouped by severity
const failing = (data.tests || []).filter(t => !t.passed);
failing.forEach(t => console.warn(`[${t.severity}] ${t.test} — ${t.result}`));{
"found": true,
"domain": "microsoft.com",
"source": "domain",
"recordCount": 1,
"dmarc": "v=DMARC1; p=reject; pct=100; rua=mailto:...; adkim=r; aspf=r",
"parsed": {
"parsed": { "v": "DMARC1", "p": "reject", "pct": 100, "rua": ["..."], "adkim": "r", "aspf": "r" },
"descriptions": { "p": "Reject failing mail", "pct": "100% rollout", "...": "..." }
},
"score": {
"grade": "A",
"effectiveEnforcement": 2.0,
"policyStrength": "reject",
"pct": 100,
"protectionState": "enforcing"
},
"reporting": {
"rua": [
{ "uri": "[email protected]", "domain": "microsoft.com", "authorized": true, "reason": "same_domain" }
],
"ruf": []
},
"compliance": {
"googleYahoo2024": true,
"microsoft2025": true,
"bimiEligible": true,
"hasRua": true
},
"tests": [
{ "test": "DMARC Record Published", "result": "...", "passed": true, "severity": "high" },
{ "test": "Single DMARC Record", "result": "...", "passed": true, "severity": "high" },
{ "test": "Policy Strength", "result": "...", "passed": true, "severity": "med" },
{ "test": "Percent Rollout", "result": "...", "passed": true, "severity": "low" },
{ "test": "External Reporter Authorization", "result": "...", "passed": true, "severity": "med" }
],
"AiAnalysis": {
"summary": "Your DMARC is at p=reject with pct=100 — full enforcement...",
"quick_recommendations": ["Publish BIMI...", "Tighten sp=..."],
"security_assessment": [{ "title": "...", "description": "...", "severity": "info | warning | critical" }],
"fixes": [
{ "issue": "...", "kind": "dns_txt | dig", "host": "_dmarc.example.com", "snippet": "v=DMARC1; ..." }
]
}
}Six patterns we see most often:
Cron the API against your domains. Alert on grade regression (A → B → C), when the effective-enforcement score drops, or when `rua=` disappears. Catches well-intentioned 'temporary' rollbacks that get forgotten.
Google/Yahoo 2024 and Microsoft 2025 bulk-sender rules mandate a published DMARC policy. Read the compliance flags from `data.compliance` — hard-fail your deploy pipeline if any sending domain regresses below the threshold.
Evaluating a SaaS vendor that will send mail on your behalf. Check their existing DMARC grade before onboarding. A vendor stuck at grade D for years tells you something about their security culture.
Acquiring a company. Grade distribution across their sending domains is a direct signal of post-acquisition work. Most acquisitions inherit `p=none` (grade D) everywhere.
A phishing campaign is using your domain. Verify grade A — and if not, this is the incident that motivates getting there. The Rollout tab shows exactly what step to publish next.
Marketing wants the logo-in-inbox. BIMI eligibility chip lights up green the moment `p=quarantine`/`reject` at `pct=100` is deployed. Read the flag; stop hunting through vendor docs.