DMARC checker
Type a domain. We read its DMARC policy, follow its SPF record to the end, and look for its DKIM keys. Then we name each service the domain allows to send as it, and say whether that service's mail can pass DMARC. The same check looks for names that copy the domain, and says who holds each part.
Or see it done for a domain we watch
Digital Footprint
Lookalikes
What the check reads
DMARC tells a receiving mail server what to do with mail that claims to come from your domain and cannot prove it. The proof is SPF or DKIM, and it counts only when the domain it proves matches the domain in the From address. A policy of reject refuses mail that fails, quarantine sends it to spam, and none asks only for reports.
Every service that sends as your domain must pass, or its mail is lost once the policy is enforced. A service passes when it signs with your domain's DKIM key, or when it sends from a return path under your domain. The check names the services your SPF record allows, and says which of those two each one can do.
It reads DNS only. It shows who may send as the domain, not who does. The aggregate reports that receivers send to the address in your DMARC record show that.