# DMARC Checker and Generator

Check a DMARC record, see what each tag does, and build the next record on the way from p=none to p=reject.

Canonical: https://tamperbox.dev/dmarc-checker

Reviewed: 2026-10-13

## Capabilities and processing

Enter a domain or paste a DMARC record. A domain is looked up at `_dmarc.<domain>` by our server; a pasted record is read in your browser.

Each tag is explained, problems are listed with fixes, and a builder edits policy, subdomain policy, percentage, report addresses, alignment and failure options. The rollout steps move the record from monitoring to quarantine at 25%, quarantine and reject. Every change is kept in a history you can revert one step at a time.

## Example workflow

harbor-supply.example monitors with p=none. Choose Try enforcement, review the draft record, then copy it to publish at _dmarc.harbor-supply.example.

## Limits and interpretation

The tool reads the policy, not the reports; it cannot tell whether legitimate mail already passes. Move to enforcement only after aggregate reports show your senders aligned. External report addresses need an authorization record at the receiving domain. The application does not persist tool inputs or results.

The lookup checks the exact `_dmarc` name. Parent-domain inheritance and external reporting authorization are not resolved; a missing exact record does not prove DMARC is absent.

## Related tools

[SPF Checker](https://tamperbox.dev/spf-checker) inspects authorized-sender records. [DKIM Record Checker](https://tamperbox.dev/dkim-checker) inspects signing keys. [Email Header Analyzer](https://tamperbox.dev/email-header-analyzer) reads reported message authentication results.

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)

## References

[DMARC: RFC 7489](https://www.rfc-editor.org/rfc/rfc7489).