DMARC Analyser
Full DMARC, SPF and DKIM analysis with a readiness score.
Enter a domain to run a full email-authentication health check. We read DMARC, SPF and MX live from DNS, score how ready you are for enforcement out of 100 and show exactly what to fix. Nothing is stored.
The DMARC Analyser reads the three records that decide whether a receiving mail server trusts mail from your domain: your DMARC policy, your SPF record and the DKIM key for a selector you supply. It parses each one, checks the syntax against the relevant RFCs, and combines the findings into a single readiness score so you can see at a glance how close you are to safely rejecting spoofed mail.
What the score actually measures
A high score is not just a passing DMARC record. The tool weights three things: whether your DMARC policy is at enforcement (p=quarantine or p=reject rather than p=none), whether SPF and DKIM are both present and aligned with the From domain, and whether you are collecting aggregate reports via rua. A domain on p=none with no reporting address scores low even if every record is syntactically perfect, because it offers no real protection against spoofing.
Reading and fixing the result
Work through the findings in order. Common problems and fixes:
- Policy stuck on
p=none: this is monitor-only. Move toquarantinethenrejectonce your reports show legitimate mail passing. See how to enforce. - SPF over ten DNS lookups: SPF permanently fails (
permerror) above the limit in RFC 7208. Flatten or consolidate yourincludemechanisms. - Alignment failing: a source can pass SPF or DKIM and still fail DMARC if the authenticated domain does not align with the From domain. Check
adkim/aspfand your sending platform's configuration. - No
rua: without aggregate reports you are blind. Add a reporting mailbox before tightening the policy.
Reaching enforcement by hand takes weeks of report-reading. DMARC Engine offers a done-for-you path that does the same analysis continuously; the free tools let you check the state yourself first.
Frequently asked questions
Why does my DMARC record pass syntax but still score low?
Syntax and protection are different things. A valid p=none record only monitors; it tells receivers to take no action on spoofed mail. The score rewards enforcement (quarantine or reject), aligned SPF/DKIM, and an aggregate reporting address, so a correct but permissive setup scores low by design.
What DKIM selector should I enter?
Use the selector your sending platform publishes, which appears in the s= tag of the DKIM-Signature header on a real message you have sent. Common examples are google, selector1, k1 or s1. DKIM keys live at selector._domainkey.yourdomain, so the analyser needs the selector to find the right key.
Does DMARC need both SPF and DKIM to pass?
No. DMARC passes if either SPF or DKIM passes and is aligned with the From domain. However, relying on a single mechanism is fragile, because forwarding usually breaks SPF and message modification can break DKIM. Having both aligned gives you resilient delivery.
What does alignment mean in the result?
Alignment is whether the domain that authenticated (the SPF MAIL FROM domain or the DKIM d= domain) matches the visible From domain. aspf and adkim control whether matching must be exact (strict) or allows subdomains (relaxed). DMARC only passes on an aligned result, not merely a passing SPF or DKIM check.
How long before I can safely move to p=reject?
There is no fixed timer. Stay on p=none with rua reporting until your aggregate reports confirm every legitimate source is passing with alignment, then move to p=quarantine, then p=reject. For most domains this takes a few weeks; complex estates take longer. See our enforcement guide.