DMARC checker
Answers the question an attacker asks first: if I forge mail from this domain, does it get delivered?
Public data, possible errors. Every result here is built only from publicly available information: DNS records, and what a server shows to anyone who connects. It can be incomplete or wrong. DNS caching, a record changed minutes ago, split-horizon DNS, or a provider that signs and routes mail on your behalf can all make the public view differ from your real configuration. Treat a result as a starting point, not a verdict, and always have an administrator with the appropriate privileged access confirm it on the systems themselves before changing anything.
What DMARC does
DMARC is a TXT record at _dmarc.your-domain that tells receiving servers what to do with mail that claims to be from your domain but fails both SPF and DKIM alignment: deliver it (p=none), send it to spam (quarantine), or refuse it (reject).
It's the only one of the three that protects the From: address people actually read, which is why it decides whether your domain can be spoofed. p=none is a monitoring mode: useful for the first weeks of a rollout, but forged mail is still delivered.
The rua= address receives daily aggregate reports from large mailbox providers listing every server that sent mail as your domain. Those reports are what make it safe to tighten the policy without blocking your own mail.
Records fixed? Now test the people.
SPF, DKIM and DMARC stop someone forging your domain. They don't stop a lookalike domain, or a colleague typing their password into one. Phishtime runs authorised phishing simulations against your own team, free for up to 25 employees.