In short: a DMARC checker reads the DMARC record your domain publishes and tells you what happens to email that pretends to be you. If the policy is p=quarantine or p=reject, fakes are sent to spam or blocked. If it is p=none, or there is no record at all, fake email in your name is usually delivered.
How to read your DMARC result
| What we find | What it means | What to do |
|---|---|---|
| No DMARC record | Receiving servers get no instruction. Anyone can send email that appears to come from your exact address, and most of it will be delivered. | Publish a DMARC record at p=none with a reporting address today, then tighten it. |
| p=none (monitor only) | You receive reports about fake email, but receivers are told to deliver it anyway. | Review the reports for two to four weeks, fix any genuine senders that fail, then move to p=quarantine. |
| p=quarantine | Email that fails checks goes to spam or junk. You are protected against most impersonation. | Once reports are clean, move to p=reject. |
| p=reject | Email that fails checks is blocked outright. This is full protection. | Keep SPF and DKIM up to date whenever you add a new service that sends email as you. |
What a good DMARC record looks like
DMARC is a single TXT record, added in the DNS settings wherever your domain is managed (your domain registrar, web host or IT provider). It lives at _dmarc.yourdomain.co.uk. A sensible first record looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.uk
And once your reports show only genuine senders passing, the end goal looks like this:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.co.uk
v=DMARC1says this is a DMARC record. It must come first.p=is the policy:none,quarantineorreject.rua=is where daily summary reports are sent, so you can see who is sending as you.
SPF and DKIM: the two checks DMARC relies on
DMARC only works if your genuine email passes at least one of two checks, and that check matches your domain:
- SPF is a list of the servers allowed to send email for your domain. You can only have one SPF record, and it must include every service that sends as you, such as Microsoft 365, Google Workspace, your booking or reminder system, and your newsletter tool.
- DKIM adds a digital signature to each email. Microsoft 365 and Google Workspace both support it, but it usually has to be switched on and published in DNS.
Our checker reports on both. For a step-by-step guide to setting them up in Microsoft 365 and Google Workspace, read What is DMARC? A plain-English guide.
Why it matters now
- Fraud: a fake email from your address is one of the easiest ways to trick patients, families or suppliers into paying a bogus invoice. Read how invoice redirection fraud works.
- Deliverability: Google and Yahoo have required authenticated email since February 2024, with DMARC required for bulk senders, and Microsoft introduced similar rules for Outlook.com in 2025. Weak records are a common reason appointment reminders go to spam.
- Compliance: email security is part of the evidence for the NHS Data Security and Protection Toolkit (DSPT) and good practice under Cyber Essentials and UK GDPR.
Frequently asked questions
What is a DMARC checker?
A DMARC checker looks up the DMARC record your domain publishes in DNS and tells you what it instructs receiving mail servers to do with email that fails authentication: nothing (p=none), send it to spam (p=quarantine) or block it (p=reject). It also checks the SPF and DKIM records DMARC relies on.
Is this DMARC checker free?
Yes. It is free, needs no sign-up and shows the result on screen. It only reads public DNS records, the same information any mail server sees, and touches nothing on your systems.
What DMARC policy should I have?
Aim for p=quarantine or p=reject. A policy of p=none only monitors: fake emails in your name are still delivered. Most organisations start at p=none for two to four weeks while they check the reports, then move to quarantine and finally reject.
Why does my domain show no DMARC record?
Either a record has never been published, or it sits in the wrong place. A DMARC record must be a TXT record at _dmarc.yourdomain.co.uk and start with v=DMARC1. If you use Microsoft 365 or Google Workspace, it is not added for you automatically.
Do I need DMARC if I am a small practice?
Yes. Size does not matter to a scammer. Without an enforced DMARC policy anyone can send email that appears to come from your exact address. In our October 2026 check of 1,337 Yorkshire healthcare providers, 83% could be impersonated this way, including 91% of dental practices.
Will setting up DMARC stop my own emails arriving?
Not if you do it in stages. Start with p=none and a reporting address, make sure every service that sends as you (Microsoft 365, your booking system, your newsletter tool) passes SPF or DKIM, then tighten the policy. Jumping straight to p=reject without checking is what causes problems.
Need a hand? We check and evidence; your IT provider makes the changes. If you would like someone to look at your result and tell you exactly what to change, contact us or call 07749 941111. Or request the free external audit for the full picture.
By Andrew Heppinstall, founder of Unavoidably Secure. Updated 16 October 2026.