Skip to content
MailCull
Free tool

Check or build your DMARC record.

DMARC tells receivers what to do with mail that fails SPF and DKIM. Check what a domain publishes today, or generate a record to publish.

We read the TXT record at _dmarc.<domain>. We don't save the domain you check.

Good to know

What DMARC does

DMARC sits on top of SPF and DKIM. It tells receivers what to do with mail that fails both checks, and where to send reports about it. It is how you move from watching spoofing to stopping it.

The checker reads a domain's current policy and explains each tag in plain English. The generator builds a record you can publish directly to DNS. Start at p=none to gather reports, then tighten to quarantine and reject once the reports look clean.

91-93% real-world accuracy on full email verification. DMARC governs spoofing policy, not whether a given mailbox exists.

What does p=none mean?
Monitoring only. Mail that fails SPF and DKIM is still delivered, but you receive daily aggregate reports. It is the safe first step before enforcement.
What is the difference between quarantine and reject?
p=quarantine routes failing mail to the spam folder. p=reject tells the receiving server to refuse the message outright. Use quarantine as a stepping stone before moving to reject.
What is the rua= tag for?
It specifies where aggregate DMARC reports go. Most teams point it at a dedicated mailbox or a DMARC reporting service. Without rua, you have no visibility into what is passing or failing.
What does the pct= tag do?
It applies your policy to a percentage of failing mail rather than all of it. pct=10 means only 10% of failures are quarantined or rejected. Useful for a gradual rollout; set it to 100 for full protection.