Truvo Free Tools

DMARC record checker

A DMARC record tells receiving mail servers what to do when a message fails SPF or DKIM, and where to send reports about it. This checker reads the record, shows whether the policy monitors, quarantines or rejects, and names the SOC 2 and ISO 27001 controls the answer affects.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 CC7.2ISO 27001 A.5.14ISO 27001 A.8.20
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the DMARC record checker works

The check is passive: it reads the public TXT record at _dmarc.yourdomain.com through DNS over HTTPS, without sending any email.

01

Query

You enter a domain. The tool asks a public DNS over HTTPS resolver for the TXT record at _dmarc. and looks for v=DMARC1. Nothing is sent to your mail servers.

02

Read

The result shows the policy: p=none (monitor only), p=quarantine (spam folder) or p=reject (block outright), and whether a rua reporting address is present. A missing record or a p=none policy is flagged.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.7 and CC7.2, and ISO 27001:2022 A.5.14 (information transfer) and A.8.20 (networks security). An enforcing policy with reporting is evidence; monitor-only is a gap to close.

Found a gap? We fix it for you.

Truvo's security engineers harden mail, DNS and TLS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • DMARC to reject

  • SPF and DKIM

  • Report monitoring

  • Redundant MX hosts

  • Audit evidence

  • Fixed-price scope

DMARC checker: frequently asked questions

It looks up the TXT record at _dmarc.yourdomain.com and reads the v=DMARC1 policy. The result tells you whether a record exists, whether the policy is none, quarantine or reject, and whether a reporting address (rua) is set so you receive reports on who is sending mail as your domain.

Truvo maps DMARC findings to SOC 2 CC6.1, CC6.7 and CC7.2, and to ISO 27001:2022 Annex A controls A.5.14 (information transfer) and A.8.20 (networks security). The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The check queries public DNS over DNS over HTTPS for records your domain already publishes to the whole internet. Nothing connects to your servers and nothing is written or changed.

p=none asks receivers to deliver the mail normally and only send you reports, so you are watching spoofing without stopping it. p=quarantine asks them to put failing mail in spam. p=reject asks them to block it. The usual path is to start at none with a rua address, use the reports to find every legitimate sender, then step up to quarantine and finally reject.

Both frameworks ask how you protect information in transit and how you detect misuse of your systems. A DMARC policy at reject, with reporting, is direct evidence that spoofed mail in your name is blocked and that you would see the attempts. A missing record is a finding an auditor will ask you to explain.