Skip to content

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain. A published record is not protection by itself. This checker reads the live _dmarc TXT, then scores policy (p=), subdomain policy (sp=), coverage (pct=), and syntax. Monitoring mode (p=none) scores zero on this scale.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. A private assessment (see the checkbox in the scan dialog) is the only difference.

65.0%
of mail-enabled Top-1M domains publish DMARC
30.8%
enforce quarantine or reject

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

SPF checker

SPF lists which hosts may send mail as your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

What is DMARC?

DMARC is a DNS policy at _dmarc.example.com that tells receivers what to do when mail fails SPF or DKIM alignment. The p= tag is the action: none (monitor), quarantine (spam folder), or reject (block). SecLens.ONE scores the live policy, not the mere presence of a record.

What is the difference between p=none and p=reject?

p=none asks receivers to take no action on failures. It is useful while you watch reports, and it scores 0 points here. p=quarantine asks them to treat failures as spam (15 points when pct is 100). p=reject asks them to refuse the message (25 points when pct is 100).

Does a DMARC record alone protect me?

No. A record with p=none, a syntax error, or pct=0 does not stop spoofing. Receivers only enforce what the policy asks. This checker reports policy, coverage, syntax, and whether aggregate reporting is configured, then still runs the rest of the email-security stack.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.