Web Security

DMARC Record Explainer

Explains each DMARC tag and flags the monitor-only p=none policy and a missing report address.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the _dmarc TXT record value, starting with v=DMARC1.
  2. Select Explain DMARC.
  3. Note the policy: p=none is monitor-only and does not stop spoofing.
  4. Confirm a rua address is set and that someone reads the reports before tightening the policy.

What dmarc record explainer does

A DMARC record is often published and then left at p=none, which feels like protection but is only monitoring - failing mail is still delivered, and the domain can still be spoofed. Moving from none to quarantine to reject is the whole point of DMARC, and a record with no aggregate report address gives you no evidence with which to make that move safely.

Paste the _dmarc TXT record value and this reads each tag in plain language: what the policy actually does, whether subdomains are covered, whether the policy is being applied to only a percentage of mail, and whether reports are being collected at all. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

Nothing to the mail - it is monitor-only. Messages that fail DMARC are still delivered; the domain just collects reports. It is a fine starting point, but a domain left at p=none is not protected against spoofing.

The rua address is where aggregate reports are sent. Without it you get no visibility into who is sending as your domain, which means no evidence with which to safely move from none to quarantine to reject.

No. You paste the record value - from your DNS provider or a dig query you run yourself - and the tool explains it. It performs no DNS query and contacts no server.