Free DMARC check
Run a DMARC check on your domain
Type a domain to get a grade with a short plain line for each email setting.
Reading DNS records
Fix your email records
CloudCentric sets up and monitors SPF, DKIM and DMARC records for business domains, and configures email security on Microsoft 365.
Public email records checked
Each row below explains one setting the checker reads from the domain's public DNS.
- 1
Mail provider
MX records name servers receiving mail for a domain, showing your mail provider, for example Microsoft 365 or Google Workspace.
- 2
SPF
SPF is a public list of servers allowed to send email for your domain, ending with a rule for everyone else.
- 3
DMARC
DMARC is a public policy telling receiving servers what to do with mail claiming to be from your domain but failing SPF and DKIM checks.
- 4
DKIM
DKIM signs outgoing messages with a key. Checkers try common selector names, so finding no key is shown as unknown.
- 5
MTA-STS
MTA-STS asks sending servers to deliver mail over an encrypted connection. Shown for information and not scored.
- 6
TLS reporting
TLS reporting asks for reports of delivery problems with encryption. Shown for information and not scored.
Scoring and grading rules
Grades are out of 100 points. DMARC counts for 60 points and SPF counts for 40 points, while other checks are shown but not scored.
- A90 to 100
Enforcing DMARC policy of quarantine or reject with SPF ending in -all or ~all.
- B75 to 89
Enforcing DMARC policy with a gap like no report address or softer SPF.
- C55 to 74
Enforcing DMARC policy with missing or weak SPF.
- D35 to 54
DMARC policy of none, or enforcing policy with weak or missing SPF.
- F0 to 34
No working DMARC record to instruct receiving servers on failing mail.
| Policy reject | 50 |
|---|---|
| Policy quarantine | 45 |
| Policy none | 10 |
| Report address (rua) set | +10 |
| pct below 100 on reject or quarantine | scaled by pct, at least 10 |
| Ends in -all | 40 |
|---|---|
| Ends in ~all | 32 |
| Ends in ?all | 10 |
| No all rule | 5 |
| Ends in +all, none, or two records | 0 |
| More than 10 DNS lookups | -15 |
| No working DMARC record | at most 34 |
|---|---|
| DMARC policy none | at most 54 |
Frequent questions
- What is spoofing and why is a business domain used?
Spoofing changes an email From address to show a domain that did not send the message. Business domains are used against customers, vendors and staff to ask for changed bank details or payments.
- What do DMARC policies of none, quarantine and reject mean?
None delivers mail as normal and reports. Quarantine treats failing messages as suspect, typically sending them to spam. Reject refuses the failing mail entirely.
- Why can DKIM checks show unknown?
Senders choose their own DKIM selector names, so checkers try only common ones. Finding no key at those common names does not prove DKIM is missing, so results show as unknown.
- Is the domain I type stored or seen?
Domain lookups run directly in your browser. Nothing you type is stored by the page, and the domain only goes to the public DNS services answering the query.
- What does a good grade show about my domain?
High grades show strong published DNS records for your domain. Grades reflect public policies, not mail flow, mailbox contents or staff email habits.
Secure your business communication
CloudCentric provides managed IT services and email security for businesses from Charleston to Savannah.