DMARC Check

What It Does

Queries the _dmarc.<domain> TXT record, validates only one DMARC record exists (multiple records are invalid), parses all DMARC tags (v, p, sp, pct, rua, ruf, adkim, aspf, ri, fo), validates syntax, and evaluates the effective security posture. Identifies policy gaps such as p=none without monitoring, missing aggregate reporting, lax alignment when strict is recommended, subdomain policy inconsistencies, and external report destinations requiring verification records (RFC 7489 §7.1). Warns about forensic report (ruf) privacy implications. Returns a security score, letter grade, and a human-readable policy description.

Why It's Useful

DMARC ties together SPF and DKIM to provide complete email authentication (RFC 7489). It tells receiving servers what to do with emails that fail authentication and provides visibility through aggregate and forensic reports. Full DMARC enforcement (p=reject) is the only way to truly prevent domain spoofing. Google, Yahoo, and Microsoft now require at minimum p=none with rua reporting for domains sending 5,000+ emails/day — with non-compliant emails facing rejection (Gmail November 2025, Outlook May 2025). The upcoming DMARCbis specification will supersede RFC 7489 with stricter reporting rules.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/security/dmarc" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=google.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/security/dmarc?domain=google.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/security/dmarc',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'google.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.