Skip to content
Check a domain

DMARC checker · first check free

DMARC checker: can someone send email as your business?

Check the DMARC record on a domain you own, see what it tells receiving servers to do, and get the exact record to publish next. Part of a full website security check.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

  • No card for the free check
  • Results usually in minutes
  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription needed
  • View sample report

Quick Scan

Areas checked
11
In good shape
4
Fixes in minutes
3 of 5
  1. Medium

    Protect the session cookie

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

    Fix

    1. Make sure every service that sends your mail passes SPF or DKIM aligned with your domain, and confirm DKIM with your email provider.
    2. Publish a _dmarc TXT record: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. p=none only monitors.
    3. When the reports show your real mail passes, move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 3 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

DMARC tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM. We read your published DMARC, SPF and DKIM records, explain what each one does in plain English, and give you the record to add or change.

  • Your first check is free: create an account and confirm your email.
  • Your DMARC policy, read from public DNS: none, quarantine or reject, and whether subdomains are covered
  • The SPF and DKIM records DMARC depends on, checked in the same report
  • For domains you own; the whole website check is included, not just DMARC

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription needed.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription needed.

  • One credit checks one website
  • Credits last 12 months
  • One-off payment, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work
Check my DMARC

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

What we check

Everything we read for your email.DMARC first, and what it depends on.

Part of every Quick Scan, alongside the other checks.

  • SPF record

    Present, valid, and ending with a clear rule for unknown senders.

  • DMARC policy

    Published, readable, enforcing, and covering your subdomains too.

  • DMARC reports

    A reporting address is set, and authorised when it is on another domain.

  • DKIM signing keys

    The keys we can find, and whether they're long enough.

  • Mail servers (MX)

    Each one exists, is a proper name, and the records agree.

  • Domains that send no email

    Locked down so nobody can send as them.

  • MTA-STS and TLS-RPT

    Incoming mail kept encrypted in transit, with reports switched on.

  • BIMI

    Your brand logo record, when you publish one.

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F3 · dns-email-auth

Add a DMARC record for your domain

Low Confirmed Minutes

What it means
A DMARC record tells receiving mail servers what to do with email that claims to come from your domain, so they can turn away mail that only pretends to be you. We look for DKIM keys under common names only and found none, so we couldn't confirm DKIM.
Evidence
_dmarc.example.com  TXT  (no record)
Expected
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
Fix
Make sure every service that sends your mail passes SPF or DKIM aligned with your domain, and confirm DKIM with your email provider. Publish a _dmarc TXT record: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. p=none only monitors. When the reports show your real mail passes, move to p=quarantine.

F1 · technology-fingerprint

Update an outdated component

Medium Likely Hours

What it means
Your site announces PHP 7.4.3. PHP 7.4 stopped getting security fixes on 28 November 2022, so new problems in it won't be fixed.
Evidence
X-Powered-By: PHP/7.4.3
PHP 7.4 — end of life 2022-11-28
Expected
A supported PHP 8 release (8.3 or later), version not announced (expose_php = Off)
Fix
Ask your host which PHP version really runs: the version a site announces can differ. Then move the site to a supported PHP version (8.x) and test it, as older code may need changes. Then stop announcing the version: set expose_php = Off.

Questions

Short answers.

Something else? support@scandefend.com

Is this a free DMARC lookup?

Your first check is free on a new account; after that it's a paid check with no subscription. The report covers DMARC, SPF, DKIM and the rest of your site's public security.

What is DMARC, and do I need it?

DMARC is a DNS record that tells mail servers what to do with email that pretends to come from your domain. Without it, anyone can send email that looks like it's from you. If your business sends email from its own domain, you need it, and Gmail and Yahoo now require it for bulk senders.

How do I check my domain's DMARC record?

Enter your domain and ScanDefend reads its public DMARC record, along with SPF and DKIM. The report says whether the record exists, what it's set to, and what to change, in plain English.

What do p=none, p=quarantine and p=reject mean?

They tell mail servers what to do with email that fails the checks: p=none means deliver it anyway and only report it, p=quarantine means send it to spam, and p=reject means refuse it. Only quarantine and reject actually stop someone sending email as you.

What does "550 5.7.509 … does not pass DMARC verification" mean?

The receiving server refused the message because it failed the sending domain's DMARC check and that domain's policy is set to reject. Usually a legitimate service sending as you, such as a newsletter tool or a website form, isn't covered by your SPF or DKIM records yet. A "554 5.7.5 permanent error evaluating DMARC policy" usually means the DMARC record itself has a mistake in it. Checking your domain shows which one applies.

What's the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send email for your domain. DKIM adds a signature that proves a message wasn't changed on the way. DMARC ties the two to your visible "From" address and tells receivers what to do when a message fails.

Which DMARC policy should I start with?

Most domains start with p=none to collect reports without blocking anything, then move to quarantine and reject once every service that sends your email passes. The report tells you where you are and the next step.

Do you need access to my email or DNS account?

No. Everything is read from your domain's public DNS records, the same ones any mail server sees. Nothing to install and no passwords.

Keep exploring

Also useful: What we check Free instant DMARC lookup

See what your website shows.Know what to fix first.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

See pricing