Check a domain
Why it matters
Email does not check the sender's address by itself. Anyone can send a message whose From line says [email protected]. Scammers use this for fake "security alert", "airdrop" and "wallet migration" emails: the sender looks real, so people click the link inside.
No takedown stops this, because the fake email uses your real domain. Only your DNS can: a DMARC record tells Gmail, Outlook, Yahoo and other mail servers to refuse email that claims to be from your domain but was not sent by your mail services.
DMARC does not cover lookalike domains such as yourproject-support.com. Those are separate domains; find them with the lookalike domain checker.
What we check
We read three things in public DNS: the DMARC record at _dmarc. plus your domain, the SPF record (a TXT record that starts with v=spf1), and whether the domain receives email (MX). We send no email and see none of yours.
- p=reject: mail servers refuse fake email. This is the goal.
- p=quarantine: fake email goes to spam, where people still find it.
- p=none: mail servers only send you reports; fake email still arrives.
- No record: nothing stops fake email.
A domain that sends no email can refuse all email in its name right away. A domain that does send email starts with p=none and reports, checks in the reports that its own mail passes, then moves to p=reject, usually within 2-4 weeks.
Frequently asked questions
Will p=reject block my own email?
Not if your own mail passes SPF or DKIM for your domain. That is why the first step is p=none with reports: they show which services send as your domain before you switch to p=reject.
My domain sends no email. Do I still need DMARC?
Yes. A domain without DMARC can be faked whether or not you use it for email. A domain that sends nothing can publish p=reject and an SPF record of v=spf1 -all right away.
Does DMARC stop lookalike domains?
No. DMARC protects only your own domain. Fake email from a lookalike such as yourproject-support.com needs a takedown of that domain.