Bulk DMARC checker: the policy, reports and alignment of up to 500 domains
In short: Paste domains and see each one's DMARC policy, subdomain policy, pct, where aggregate reports go, SPF and DKIM alignment, and any error that makes receivers ignore the record. Limit: It reads the published record. It can't tell you whether your real mail passes DMARC; your aggregate reports show that.
A bulk DMARC checker reads the DMARC record of many domains at once. Paste up to 100 domains, or 500 after a free Google sign-in, and each row shows the policy (none, quarantine or reject), the subdomain policy, pct, where aggregate reports go, SPF and DKIM alignment, and any error that makes receivers ignore the record. Filter by policy and download the CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
acme.example rejects mail that fails DMARC; globex.example is still on p=none.
- Domain
- acme.example
- pct
- 100
- Reports
- acme.example
What this means for you
p=none sends reports but still delivers spoofed mail. Quarantine or reject stops it.
- p=, sp= and pct= for every domain
- Where aggregate reports go
- Inherited and broken records flagged
- 100 a run, 500 signed in; CSV
- DMARC
- p=none
- rua
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français · Türkçe · 简体中文 · Русский · Nederlands · Italiano · Tiếng Việt · Bahasa Indonesia · Polski · العربية · Українська · Čeština · Magyar · 日本語 · 한국어
Fixing DMARC before a campaign? Check the list too.
- DMARC decides what happens to mail that fails authentication. It doesn't stop bounces, which hurt the same sender reputation. Upload the list at /verify to remove addresses that would bounce.
- The first 100 email checks are free with a Google sign-in, no card. For SPF and DKIM on the same domains, use the bulk email authentication checker.
How do I check DMARC on many domains at once?
- Paste domains, one per line, up to 100 a run, or 500 after a free Google sign-in. Email addresses and URLs work too; the domain is taken from each.
- Press Check DMARC. Each domain's
_dmarcTXT record is read; when a subdomain has none, its organisational domain's record is used, as receivers do. 25 domains a request, DNS only. - Read each row: Reject, Quarantine, Monitoring only (p=none), Partly enforced (pct under 100), Broken or No DMARC, with the tags behind it.
- Filter by policy, for example every domain still on p=none, and download the CSV with the record and each tag.
Example
- You enter
- Three domains:
acme.example(p=reject),globex.example(p=none) andinitech.example(no record). - You get
- acme.example: Reject, pct 100, reports to one rua address. globex.example: Monitoring only, p=none. initech.example: No DMARC. Filter by policy and download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 25 domains a request; DNS only.
What does a bulk DMARC check show?
DMARC, defined in RFC 7489, is a TXT record at _dmarc.<domain> that tells receivers what to do with mail that fails SPF and DKIM alignment: p=none (deliver and report), p=quarantine (treat as suspicious, usually spam) or p=reject (refuse it). This tool reads that record for every domain you paste and splits it into its tags.
Each row shows the policy, the subdomain policy (sp=), the share of failing mail the policy applies to (pct=), the addresses aggregate reports go to (rua=), and whether SPF and DKIM alignment are relaxed or strict. When a subdomain has no record of its own, the organisational domain's record is used and the row says it is inherited.
What do the labels mean?
Reject and Quarantine mean the domain is at enforcement: receivers that honour DMARC refuse or filter spoofed mail. Partly enforced means pct is under 100, so only part of the failing mail gets the policy. Monitoring only is p=none: reports are on, and spoofed mail is still delivered.
Broken means receivers apply no policy at all: more than one DMARC record, or a record with no valid p= tag and no rua= address (with a rua= address, receivers treat a missing p= as p=none, so it shows as Monitoring only). No DMARC means there is no record at all, which doesn't meet the Gmail and Yahoo requirement that bulk senders publish one.
How is this different from the bulk email authentication checker?
The bulk email authentication checker gives each domain a pass, warn or fail across SPF, DKIM, DMARC and MX. This tool goes deeper on DMARC alone: every tag in its own column, a filter by policy, and where each domain's reports go, so you can see, for example, which of 200 client domains are still on p=none and which have no report address.
For one domain with every tag explained and a fix list, use the single DMARC checker; to write a new record, use the DMARC generator.
Do cold email domains need DMARC?
Yes. Google's email sender guidelines require a DMARC record on domains that send bulk mail to Gmail, and Yahoo asks the same. p=none meets that minimum. Many teams leave their sending domains on p=none with reports on, and move their main domain to quarantine or reject once the reports show every real sender passing.
A missing record on one of many secondary sending domains is easy to miss, which is what a bulk check is for.
Which DMARC tool should I use?
| Bulk DMARC checker | Bulk email authentication checker | DMARC checker | |
|---|---|---|---|
| Domains per run | 100, or 500 signed in | 100, or 500 signed in | One |
| DMARC tags | Each in its own column | One status and reason | Each explained, with fixes |
| SPF, DKIM and MX | No | Yes | No |
| Filter by policy | Yes | No | No |
Who uses this tool, and for what?
- Cold emailers
- Check every secondary sending domain has a DMARC record before a campaign, and spot the ones you missed.
- Agencies
- See which client domains are still on p=none and which send reports nowhere.
- Email admins
- Audit DMARC across all the domains and subdomains a company owns, including parked ones.
- Security teams
- Find domains with broken records, which receivers treat as having no DMARC at all.
What can’t this tool tell you?
- It reads the published record. It can't tell you whether your real mail passes DMARC; your aggregate reports show that.
- Report addresses on another domain need that domain's authorisation record, which this tool doesn't check.
- A DNS timeout shows as Lookup failed; run those rows again.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check DMARC for many domains?
- Paste the domains into a bulk DMARC checker like this one. It reads each _dmarc record and shows the policy, sp, pct, report addresses and alignment, with a CSV download.
- Is this bulk DMARC checker free?
- Yes. Up to 100 domains a run without an account, and up to 500 a run when you sign in with Google, with no card.
- What does Monitoring only mean?
- The domain is on p=none: receivers send reports but deliver failing mail as normal. It meets the Gmail and Yahoo minimum but doesn't stop spoofing.
- Why does a subdomain show an inherited record?
- It has no DMARC record of its own, so receivers use the organisational domain's record and its sp= policy. The row shows the record it used.
- What makes a DMARC record broken?
- More than one v=DMARC1 record at the same name, or no valid p= tag. In both cases receivers apply no DMARC policy at all.
- Does it send any email?
- No. It only reads DNS TXT records. Nothing is sent to the domains or their mail servers.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.