Does a DMARC checker send test email?

No. It reads your public DNS record. That is enough to tell whether your domain enforces email auth or just watches failures.

What is the difference between p=none and p=reject?

p=none is monitor only. Mail that fails SPF or DKIM still gets delivered. p=reject tells receivers to block it.

Can I use a DMARC checker without DNS access?

Yes. RedScore reads public DNS. You can check any domain from the outside without logging into your registrar.

Does DMARC work without SPF and DKIM?

DMARC relies on SPF and DKIM results. Set those up first, then add DMARC to tell receivers what to do when they fail.

What does a DMARC checker test?

It reads your public _dmarc DNS TXT record and checks three things: whether the record exists, what policy is set, and whether common misconfigurations are present.

A DMARC checker does not log into your mail provider. It does not read your inbox. It looks up what anyone on the internet can see in DNS.

What specific checks does it run?

Record presence. Is there a _dmarc.yourdomain.com TXT record at all? Missing DMARC means receivers have no instructions for failed mail.

Policy enforcement. What is the p= value? none means monitor only. quarantine sends failed mail to spam. reject blocks it. Most domains stuck at p=none are not actually protected.

Alignment and tags. Does the record include reporting addresses (rua, ruf)? Are subdomain policies set? Misconfigured tags mean you miss failure reports or leave subdomains open.

SPF and DKIM context. DMARC only works when SPF and DKIM are in place. A good checker flags when DMARC exists but the underlying auth records are missing or weak.

What does RedScore's DMARC check cover?

RedScore runs a passive outside-in scan. The email auth category includes DMARC, SPF, and DKIM checks together. See the DMARC checker page for the full list of signals it evaluates.

Go to /lookup and enter your domain. The report shows whether DMARC is present, what policy is active, and what to fix first.

What should I do if DMARC fails the check?

Add a _dmarc TXT record if one is missing. Start with p=none to collect reports.
Make sure SPF and DKIM are working before enforcing.
Review DMARC reports for a week to catch legitimate mail that fails.
Move to p=quarantine, then p=reject.
Rescan from /lookup after DNS changes propagate.

Your mail provider (Google Workspace, Microsoft 365, SendGrid, etc.) usually has a DMARC setup guide. Follow that, then verify with a scan.

What is a DMARC checker not?

It is not a phishing test. It is not a mail deliverability audit. It is not a review of your mail server configuration behind the firewall.

It is the public check that tells you whether your domain actually blocks spoofed mail or just watches it happen. That is usually the first question a security-conscious buyer asks about your email setup.