DNS History
What it is: a chronological timeline of every DMARC and SPF record change DMARCS has observed for your domain, each entry showing the record type and its full raw value at that point in time.
How to use it: this only works for one domain at a time, select a specific domain (not "All Domains") in the header, then click Scan Now to force a fresh check on top of the historical timeline.
Why use it: it's the first place to look when something breaks. Instead of guessing what changed, you can see exactly what your DMARC or SPF record said before and after any point in time.
Domain Health (Investigate)
What it is: a real, live email-delivery test, not a static DNS scan. It confirms your authentication actually works end-to-end by sending a real message and reading back the real result.
How to use it: send an email from your domain to the fixed address check@dmarcs.com, including the random test code DMARCS generates for you on the page (copy both with one click). Click Check Results; DMARCS polls for the message to arrive.
What the results show: once your test email is found, you'll see the subject it received, and a pass/fail/unknown badge for every authentication mechanism present in that message's headers (SPF, DKIM, DMARC). This tells you what a real receiving mail server actually saw, which is the most direct way to confirm your setup works, rather than inferring it from DNS records alone.
If it says "email not found yet," your test email may just still be in transit, wait a moment and check again. A distinct message appears if DMARCS itself can't be reached, so you don't mistake a connectivity issue for a failed test.
DNS Inspector suite
Three related tools grouped together, each answering a different diagnostic question.
- DNS Inspector: enter a domain and get a found/missing status for every record DMARCS checks in one pass: DMARC, SPF, MX, MTA-STS, and TLS reporting, each with the raw record shown when found.
- DKIM Inspector: tracks every DKIM selector you've published, showing an estimated key strength (2048-bit, 1024-bit flagged as weak), where DMARCS learned about that selector (from a report, a DNS scan, or added manually), and a live status check. Scan DNS also probes a list of common selector names to auto-discover keys you haven't told DMARCS about yet.
- SPF Surveyor: renders your entire SPF chain as a visual tree, recursively following every
include: and redirect= so you can see the full structure at a glance, and automatically recognizes common vendors (Google Workspace, Microsoft 365, Salesforce, Mailchimp, and others) inside that chain.
Before you click "Scan DNS" in DKIM Inspector: it re-validates every selector you're already tracking, and any that no longer resolve are removed permanently. If you have selectors tracked already, DMARCS asks you to confirm first.
Header Analyzer
What it is: paste the raw headers from any email and get a full breakdown of its authentication and delivery path.
What you'll see: an overall verdict (safe, warning, or danger), a plain-language summary of who actually sent the message and whether it's verified, a hop-by-hop relay path with each server's location and blacklist status, pass/fail results for SPF, DKIM, DMARC, and ARC, and, when available, receiving-end checks like TLS encryption and spam-filter verdict. A single 0-100 score summarizes the overall sender identity confidence.
Gmail: open the email → three dots → Show original.
Outlook: open the email → three dots → View message source.
