The best free DMARC checkers, ranked

A DMARC checker is a tool that reads a domain’s DMARC record from DNS and reports the policy, the reporting addresses, and any errors, usually together with the SPF and DKIM records DMARC builds on. Free checkers come in two kinds: record checkers that look up DNS, and mail testers that evaluate a real message you send them.

The difference matters. A record checker tells you what you published. A mail tester tells you whether a real message from your real mail server passes. You want both answers before a policy change.

Since February 2024, Gmail and Yahoo require SPF, DKIM, and DMARC from anyone sending 5,000 or more messages a day to their users, and Outlook.com followed in May 2025. Everyone else needs at least SPF or DKIM. The checkers below show where a domain stands.

Tool	Type	What it tests	Free tier
MXToolbox SuperTool	Record checker	SPF, DMARC, DKIM (selector needed), MX, blocklists	Free lookups, no signup
dmarcian	Record checker	DMARC, SPF include tree, DKIM	Free inspectors, no signup
Learn DMARC	Mail tester	A live message, step by step	Free, no signup
mail-tester	Mail tester	Authentication plus spam score	Limited free tests, paid credits
Google Admin Toolbox	Record checker	MX, SPF, DMARC for Google Workspace	Free, no signup

1. MXToolbox, the widest free toolbox

MXToolbox is the default first stop: one search box that answers DMARC, SPF, DKIM, MX, and blocklist lookups. The SPF check flags duplicate records, syntax errors, and too many DNS lookups. The DMARC check parses the policy tag by tag.

The limits: DKIM needs the selector, which most people do not know, and results come back as a flat list of passes and failures with upsell banners around them. Monitoring and alerts need an account.

2. dmarcian, the clearest SPF picture

dmarcian’s free inspectors are the most readable record checkers. The SPF Surveyor draws the whole include tree, so you see which vendor’s include pulls in which lookups. That is the view you need when SPF breaks the 10-lookup limit.

The DMARC Inspector explains each tag in plain words. Like every record checker, it tells you what is published, not whether your mail actually aligns.

3. Learn DMARC, the live message explained

Learn DMARC shows you a generated address. You send it an email from your normal mail setup, and the page walks through how a receiving server evaluates that message: SPF result, DKIM signature, alignment with the From domain, and the final DMARC verdict, step by step.

It answers the question record checkers cannot: does this specific mail from this specific system pass. Run it once per sending system, your mailbox, the newsletter tool, and the invoicing software.

4. mail-tester, deliverability in one score

mail-tester works the same way: send a message to a generated address, and it reports a score out of ten. Authentication is one part; it also checks content, links, blocklists, and formatting, which makes it the closest free answer to “will this land in spam”.

The free tier allows a limited number of tests, with paid credits beyond. For authentication alone, the record checkers above go deeper.

5. Google Admin Toolbox, for Workspace domains

Google’s Check MX tool validates MX, SPF, and DMARC for a domain and points to Google’s own setup guides. It is plain and trustworthy, and it is built around Google Workspace. Domains on Microsoft 365 or another provider get less out of it.

What SPF, DKIM, and DMARC each do

The three records solve different parts of one problem: proving a message really comes from your domain.

Record	What it proves	Typical failure
SPF	The sending server may send for the domain	A new tool sends mail, nobody added its include
DKIM	The message was signed and not altered	The provider’s signing was never switched on
DMARC	SPF or DKIM pass and match the From domain	Policy stuck at p=none, nobody reads reports

DMARC is the part receivers act on. A message can pass SPF and still fail DMARC when SPF passes for the newsletter provider’s domain instead of yours. That is alignment, and it is the most common reason a “green” SPF check still ends in spam.

The mistakes checkers find most

The same handful of errors shows up on most small business domains:

• Two SPF records. Only one is allowed. Two means SPF fails outright.
• More than 10 DNS lookups in SPF. RFC 7208 caps them at 10. Every extra include from a CRM, shop, or ticket system pushes toward it.
• Forgotten senders. The invoicing tool, the shop, and the newsletter send as your domain, but only the mailbox provider is authorized.
• p=none forever. It monitors, but it protects nothing. It is a start, not a destination.
• No rua address. Without aggregate reports, nobody knows which systems fail before the policy gets stricter.

Most of these come from tool sprawl: each new system adds a sender. The same inventory logic as for twelve tools and no time applies: list every system that sends mail, then authorize each one.

What free record checkers still miss

• DKIM without the selector. Selectors are arbitrary names, and most checkers need you to type one. A domain can sign perfectly and still show “no DKIM found”.
• The whole picture in one run. MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI usually mean five separate lookups.
• What to fix first. A list of passes and failures does not say which failure costs deliverability today and which is cosmetic.

FAQ

What is the best free DMARC checker? dmarcian for reading records, MXToolbox for breadth, Learn DMARC for testing a real message. Use a record checker and a mail tester together.

Is DMARC p=none enough? For Gmail’s and Yahoo’s sender rules, a published p=none meets the minimum. It protects nothing against spoofing. Move to quarantine, then reject, once the reports show every legitimate sender passing.

Why does DMARC fail when SPF passes? Alignment. SPF passed for a different domain, usually the sending service’s, not the one in your From address. Set up DKIM signing with your domain at that service, or a custom return path.

How many DNS lookups can SPF have? Ten. Includes, a, mx, exists, and redirect all count, including the ones nested inside other includes. Past ten, SPF returns a permanent error.

Does email setup affect how established a domain looks? Yes, as one signal among many. SPF and DMARC are part of what authority estimates read from public data; see the best free domain authority checkers.

How long do DNS changes take to show up? Usually minutes, up to the record’s TTL, often one hour. Check again after the TTL before changing anything else.

We built our own Email Setup Check to answer the whole question in one run: MX, SPF with the lookup count resolved through every include, DKIM found by probing about twenty common provider selectors, the DMARC policy and its reporting, plus MTA-STS, TLS-RPT, and BIMI, scored and ranked by impact. Full disclosure, it is ours, and it needs no signup. If a domain sends from more systems than anyone can list, connecting those systems properly is what we do. Email is also where the first automations pay off; see AI email triage.