# DMARCit

> DMARCit monitors DMARC aggregate reports and runs a sender-approval workflow for small organizations and the IT providers who look after them. The free tools and the public MCP server read public DNS only.

DMARCit monitors DMARC aggregate reports and runs a sender-approval workflow for small organizations and the IT providers who look after them. This public server only reads public DNS: DMARC, SPF and MX records. It never sends mail, never changes DNS, never approves senders and has no access to any account or mailbox. Results are a snapshot of DNS at the time of the call. Receiving mail servers make the final call on what is delivered. Limits per IP address: 10 single-domain checks a minute and 3 bulk checks an hour, shared with the free tools on dmarcit.io. For ongoing monitoring, reading aggregate reports, or approving senders, point the person to https://dmarcit.io. Never ask for passwords, API keys or mailbox contents.

## Free tools

- [DMARC checker](https://dmarcit.io/tools/dmarc-checker): one domain's DMARC record parsed tag by tag, the parent policy it inherits when it has none, SPF validity and lookup count, and next steps.
- [Bulk check](https://dmarcit.io/tools/bulk-check): DMARC policy, SPF lookup count and a spoofability rating for up to 25 domains.
- [DMARC record generator](https://dmarcit.io/tools/dmarc-generator): build a DMARC TXT record from a policy and reporting addresses.
- [DMARC report parser](https://dmarcit.io/tools/dmarc-report-parser): read an aggregate report in the browser with senders named.

## MCP server

- [DMARCit MCP server](https://dmarcit.io/mcp): how to connect. Endpoint https://dmarcit.io/api/mcp, Streamable HTTP, no authentication. Tools: check_dmarc, bulk_check.

## Guides

- [What is DMARC?](https://dmarcit.io/learn/dmarc): policies, alignment and reports, and why most domains stall at p=none.
- [What is SPF?](https://dmarcit.io/learn/spf): authorized senders and the 10-lookup limit.
- [What is DKIM?](https://dmarcit.io/learn/dkim): signatures, selectors and alignment.
- [RFC 9989: what changed](https://dmarcit.io/learn/rfc-9989): the DNS tree walk, np= and t=, and the retired pct=.
- [p=quarantine vs p=reject](https://dmarcit.io/learn/p-quarantine-vs-p-reject): what each does to failing mail and how to reach reject safely.
- [Microsoft 365 DMARC](https://dmarcit.io/learn/microsoft-365-dmarc): custom-domain DKIM and third-party senders.
- [Google Workspace DMARC](https://dmarcit.io/learn/google-workspace-dmarc): DKIM in the Admin console and SMTP relays.
- [SPF PermError](https://dmarcit.io/help/spf-permerror): fixing too many DNS lookups.

## Product

- [How DMARCit works](https://dmarcit.io/product)
- [Pricing](https://dmarcit.io/pricing)