SPF & DMARC Checker

Test a domain's email authentication: SPF, DKIM and DMARC records are checked for syntax, lookup limits and policy strength, with plain-English fixes.

Why SPF, DKIM and DMARC matter

Email was designed without sender verification, so anyone can put your domain in the "From" line. Three DNS-based standards fix that. Since February 2024, Google and Yahoo have required them from bulk senders, and missing records are now a common reason legitimate mail lands in spam.

  • SPF lists the servers allowed to send mail for your domain, in a TXT record starting with v=spf1.
  • DKIM adds a cryptographic signature to each message; receivers verify it with a public key published at selector._domainkey.yourdomain.
  • DMARC (at _dmarc.yourdomain) tells receivers what to do when SPF and DKIM fail to align with the From domain (none, quarantine or reject) and where to send reports.

What this checker tests

  • SPF exists, there is only one record, it ends in ~all or -all (never +all), and the total number of DNS lookups including nested include: mechanisms stays within the RFC 7208 limit of 10.
  • DKIM keys on the selector you supply, or on a dozen common selectors used by Google Workspace, Microsoft 365 and popular sending services.
  • DMARC exists, has a valid policy, applies to 100% of mail and sends aggregate reports so you can see who is sending as you.

Example records

example.com.         TXT  "v=spf1 include:_spf.example.net ip4:192.0.2.0/24 -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s"
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

Recommended rollout

  1. Publish SPF covering every service that sends for you, ending with ~all.
  2. Turn on DKIM signing in each provider.
  3. Publish DMARC with p=none and an rua address, and review reports for two to four weeks.
  4. Move to p=quarantine, then p=reject, once all legitimate mail passes.

Full walkthrough: SPF, DKIM and DMARC explained.

Frequently asked questions

Should I use ~all or -all?

With DMARC in place, either works; DMARC decides the outcome. ~all is the safer starting point; -all is stricter once you are confident every sender is listed.

What does "too many DNS lookups" mean?

Each include, a, mx, exists and redirect costs a lookup, including those inside included records. Over 10, SPF fails for everyone. Remove unused services or replace includes with ip4/ip6 ranges.

Do parked domains need these records?

Yes. Protect domains that never send email with v=spf1 -all and v=DMARC1; p=reject.

Copied to clipboard