DMARC checker
Look up any domain's DMARC record and read it in plain English: the policy, who gets the reports, the rollout percentage, and what is worth fixing. No signup.
Same check from your code
The API returns has_dmarc and has_spf on every email and domain score, and folds a missing policy into the risk score alongside domain age, MX and disposable detection — so the check runs on every signup rather than one domain at a time.
curl "https://www.layercall.com/v1/score/domain?domain=example.com" \ -H "x-api-key: YOUR_KEY"
1,000 lookups a month free, no card. Get a key or read the docs.
What each signal means
p= — the policy
What a receiving mail server should do with a message that claims to be from this domain and fails authentication. none delivers it anyway, quarantine sends it to spam, reject refuses it.
This is the whole point of DMARC, and most domains that have a record at all sit at p=none for years. p=none is monitoring — it is where you start, not where you finish.
rua= — aggregate reports
An address that receives a daily XML summary from every major receiver: how much mail claimed to be from you, from which IPs, and whether it passed.
Without it a DMARC record is blind. You cannot move to p=reject safely until the reports show that every legitimate sender — your mail provider, your CRM, your ticketing tool — is passing.
pct= — rollout percentage
The share of failing mail the policy is applied to. Defaults to 100.
pct=10 with p=reject means one failing message in ten is rejected and nine are delivered. Useful for a week during rollout; a hazard if it is forgotten, because the record reads as enforcing when it mostly is not.
sp= — subdomain policy
A separate policy for subdomains. Inherits p= when absent.
Attackers spoof subdomains that have never sent mail — billing.example.com, secure.example.com — precisely because nobody thought to protect them. sp=reject closes that while the main domain is still at quarantine.
adkim / aspf — alignment
Whether the domain DKIM signed with, or the SPF envelope domain, must match the visible From domain exactly (strict) or may be a subdomain of it (relaxed).
Relaxed is the default and is right for almost everyone. Strict breaks the moment a provider signs as mail.example.com, and the reports are where you find that out.
Questions
What does a DMARC checker actually tell me?
It fetches the TXT record at _dmarc.yourdomain and reads it back to you. That record is a public instruction to every receiving mail server in the world about what to do with mail that claims to be from you and cannot prove it. The checker shows the instruction you actually published — which is often not the one you meant to.
Is p=none enough?
No, but it is the right first step. p=none enforces nothing: spoofed mail is delivered exactly as before. What it does is start the reports. Run it with an rua= address until the aggregate reports show every legitimate sender passing, then move to p=quarantine, then p=reject. Domains that skip straight to reject lose real mail; domains that stay at none forever get spoofed.
Why does my record say p=reject but spoofed mail still gets through?
Three usual reasons. pct= is set below 100, so most failing mail is still delivered. The spoof is on a subdomain and sp= is not set to reject. Or the receiving server does not honour DMARC — most large ones do, many small ones do not, and DMARC can only ask.
Do subdomains inherit the policy?
Yes, unless sp= says otherwise. A record at _dmarc.example.com with p=reject and no sp= tag rejects for mail.example.com too. The exception is a subdomain that publishes its own _dmarc record, which takes precedence.
What is the difference between DMARC, SPF and DKIM?
SPF is a list of servers allowed to send as your domain. DKIM is a cryptographic signature on each message. Both are checks; neither says what to do on failure, and neither on its own stops someone forging the From address a person actually sees. DMARC ties them to the visible From domain and states the policy. You need SPF or DKIM for DMARC to have anything to check; you need DMARC for either to be enforced.
Does DMARC affect fraud detection?
It is one of the signals. A domain that publishes neither SPF nor DMARC is measurably more likely to be throwaway infrastructure, and our email scoring treats a missing policy as a small risk factor — small, because plenty of legitimate businesses have never set it up. Combined with a domain registered last week and no website, it is a different picture.