DMARC Inspector
Check and validate DMARC policy records — parse every tag, validate reporting addresses, and catch policy gaps.
What is a DMARC Inspector?
A DMARC inspector is a tool that checks a domain's Domain-based Message Authentication, Reporting & Conformance record — the v=DMARC1 TXT record published at _dmarc.<domain> that tells receiving mail servers what to do with messages that fail SPF and DKIM alignment. DMARC is a domain-level control defined in RFC 7489: the path of a URL does not matter, only the registered domain. A correct DMARC policy is what actually stops attackers from spoofing your domain.
HTTPSense's DMARC Inspector resolves the record — falling back to the organizational domain when a subdomain has none — and parses every tag: the policy, subdomain policy, alignment modes, enforcement percentage, and reporting addresses. It validates each rua and ruf URI, flags external destinations that need authorization, and surfaces problems like a missing record, p=none monitoring-only mode, partial pct coverage, and absent reporting — then assigns a letter grade. It's free and requires no signup.
How to Use the DMARC Inspector
- Enter a domain name or URL in the search bar and click Inspect DMARC.
- Review the Summary tab for the record, the policy, alignment, coverage, and the overall grade.
- Open the Tags tab to see every parsed tag and what it means.
- Use the Reporting tab to check each
ruaandrufaddress and whether external destinations are authorized. - Check the Findings tab for severity-ranked issues and concrete remediation steps.
- Use the Raw tab to copy or download the full JSON response.
How the DMARC Inspector Works
When you submit a domain or URL, we strip the scheme, port, and path to extract the bare hostname and query _dmarc.<domain> for its TXT record through Cloudflare's public resolver (1.1.1.1). If the subdomain publishes no record, we fall back to the organizational domain — the registrable domain derived from the public suffix list — and report which domain the effective policy was resolved from.
The record is parsed against the DMARC grammar, applying defaults where tags are omitted: the policy (p), subdomain policy (sp), DKIM and SPF alignment (adkim, aspf), enforcement percentage (pct), reporting addresses (rua, ruf), failure options (fo), report format (rf), and interval (ri). Each reporting URI is validated for a supported scheme, and for destinations on a different organizational domain we check for the required <domain>._report._dmarc.<destination> authorization record.
Finally we evaluate a findings catalog — missing or multiple records, p=none or p=quarantine instead of reject, partial pct, missing aggregate reporting, invalid reporting URIs, unauthorized external destinations, and invalid tag values — and translate them into a 0–100 score and an A–F grade. We do not send any email or probe SMTP; the analysis is purely DNS-based.
Key Features
- Full tag parsing — Every DMARC tag with applied defaults and a plain-English meaning.
- Organizational-domain fallback — Resolves the effective policy for subdomains with no record of their own.
- Reporting validation — Checks each
ruaandrufURI scheme and destination. - External-destination authorization — Verifies the
_report._dmarcrecord cross-domain reporting requires. - Policy grading — Distinguishes monitoring-only
p=nonefrom enforcingquarantineandreject. - Findings & remediation — Severity-ranked issues, each with a concrete fix.
- Scored grade & raw JSON — A 0–100 score mapped to an A–F grade, plus the full response for scripting.
Common Use Cases
- Email administrators — Confirm the policy is enforcing and reporting before declaring DMARC done.
- DevOps engineers — Audit DMARC alignment and reporting when onboarding a new sending platform.
- Security engineers — Catch
p=noneand partialpctgaps that leave a domain spoofable. - Deliverability specialists — Verify aggregate reporting is wired up to diagnose authentication failures.
Frequently Asked Questions
What does the DMARC policy (p) tag mean?
The p tag is the action receiving servers take when a message fails DMARC. p=none only monitors and still delivers failing mail, p=quarantine sends it to spam, and p=reject blocks it outright. p=none is a safe starting point for collecting reports, but a domain is only protected from spoofing once it reaches p=quarantine or p=reject. The Inspector grades the policy accordingly.
What is the difference between rua and ruf reports?
rua addresses receive aggregate reports — daily XML summaries of authentication results across all senders, which are safe to enable and essential for monitoring. ruf addresses receive forensic reports — per-message failure samples that can contain personal data, so many receivers do not send them. The Inspector validates both, checks the URI scheme, and flags external destinations that need an authorization record.
What is DMARC alignment?
Alignment requires the domain that passes SPF or DKIM to match the domain in the visible From header. The aspf and adkim tags control this: relaxed (r) allows a subdomain match while strict (s) requires an exact match. Without alignment a message could pass raw SPF or DKIM for an unrelated domain yet still be spoofing yours, which is why DMARC layers alignment on top.
Why does the Inspector check an organizational domain?
If a subdomain has no _dmarc record of its own, DMARC falls back to the policy published at the organizational domain (the registrable domain, like example.com for mail.example.com). The Inspector performs this fallback and shows which domain the effective policy was resolved from, so you understand the policy that actually applies.
Does this replace SPF and DKIM?
No. DMARC builds on SPF and DKIM rather than replacing them — it ties their results to the visible From domain through alignment and publishes a policy and reporting addresses. The DMARC Inspector focuses on the DMARC record; dedicated SPF and DKIM inspectors are also available on HTTPSense.