warnwell

Warnwell / Checks

DMARC checker for one domain or fifty

Paste your domains. For each one you get the DMARC record as published, what it means for mail that fakes your address, and the line to change.

  • Free
  • No sign-up
  • Up to 50 domains at once

01

What the DMARC result means

The record lives at _dmarc.yourdomain.com, and the part that matters is p=. That is your instruction to Gmail, Outlook and the rest for mail that says it is from you but fails SPF and DKIM. Warnwell turns it into one of these lines:

RecordWarnwell saysWhat happens to a fake
none foundAnyone can send email as @yourdomainDelivered
p=noneAnyone can send email as @yourdomainDelivered, and you get a report
p=quarantineFake email goes to spam, not awayPut in the spam folder
p=rejectProtected against fake emailRefused before anyone sees it

Watch for pct=. Set to 50, half the failing mail gets the policy and half doesn't, so we grade p=reject; pct=50 as amber, like quarantine.

The fix you get depends on whether the domain sends mail. If it has MX records, or SPF lists a sender, we assume it does, and the advice is the slow route: p=none with a report address, two to four weeks of reading reports, then up. If neither is there, you get the three records that lock a no-mail domain down in one go, reject included.

02

Why check many domains

Most businesses look after their main domain and forget the rest: the old brand, the country versions, the name bought for a launch in 2019. Those are the ones scammers pick, since nobody gets the bounce-backs. Paste the whole list and sort by the red lamps.

You also get SPF, DKIM, the expiry date and the website in the same row. Perfect DMARC is no help on a domain that lapses next month.

03

Questions

How do I look up a DMARC record by hand?
Ask DNS for the TXT record on the _dmarc name, with dig +short TXT _dmarc.example.com in a Mac or Linux terminal, or nslookup -type=TXT _dmarc.example.com on Windows. Warnwell runs that same query through a public resolver and prints what comes back under "DMARC record", so you can compare.
My DMARC record exists. Why is the email lamp red?
Because the policy is p=none. That setting only collects reports. Fake mail is still delivered, so Warnwell grades it the same as having no record. Read why p=none does not stop fake email.
Does this read my DMARC reports?
No. Reports go to the address in rua= and only you receive them. Warnwell reads the public DNS records, nothing else.
How many domains can I check?
Up to 50 per run, free, without an account. Download the results as CSV if you want them in a spreadsheet.
04

Updated 20 Oct 2026.