by GelFuzion
Home / Domain & Security / SPF & DMARC Checker
06.04Domain & Security

SPF, DMARC & DKIM Checker

Audit a domain's email authentication in one pass. Every SPF mechanism explained, nested DNS lookups counted against the limit of 10, DMARC graded, and the fixes written in plain English.

Updated
Find yours in a sent email's DKIM-Signature header, the s= value.

Enter a domain you send email from. Try github.com.

DMARC record builder

Start at none with reporting on, read the reports for two to four weeks, then tighten.

Host / name
_dmarc
TXT value

      


      

      

        
How SPF, DKIM and DMARC fit together

        
Email was designed without any way to prove who sent a message. Three DNS-based standards bolt that proof on after the fact, and receivers like Gmail, Outlook and Yahoo now expect all three from anyone sending at volume.

        
    
          
  • SPF lists the servers allowed to send mail for your domain. It checks the hidden envelope sender (the Return-Path), not the From address people see.
    • 
          
  • DKIM adds a cryptographic signature to each message. The public key sits in DNS at selector._domainkey.yourdomain.com.
    • 
          
  • DMARC ties them to the visible From address. A message passes DMARC if SPF or DKIM passes and the domain that passed aligns with the From domain. DMARC also tells receivers what to do with failures and where to send reports.
    • 
        


        
Reading an SPF record

        
An SPF record is a single TXT record that starts with v=spf1, followed by mechanisms evaluated left to right. The first one that matches the sending IP wins.


v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all

        
That record says: Google Workspace may send, SendGrid may send, one office server may send, and anything else should soft-fail. Each mechanism can carry a qualifier: + pass (the default), - fail, ~ soft fail, ? neutral.


        
The 10-lookup limit

        
To stop SPF from being used for denial-of-service, evaluation may trigger at most 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, and the cost of nested includes counts too. ip4, ip6 and all are free. Google Workspace alone uses about four, and adding Microsoft 365, a CRM and a newsletter tool can push a domain over without anyone noticing. Over the limit, receivers return PermError and SPF effectively fails.

        
To get back under: remove services you no longer use, swap a and mx for explicit ip4 ranges where your server IPs are stable, and move marketing tools to a subdomain like news.yourdomain.com with its own SPF record.


        
Mistakes this checker flags

        
    
          
  • Two SPF records. Publishing a second v=spf1 TXT instead of editing the first breaks both. Merge them.
    • 
          
  • +all authorizes the entire internet to send as you. ?all is nearly as useless.
    • 
          
  • ptr is deprecated, slow and ignored by some receivers.
    • 
          
  • Missing all at the end means unknown senders get a neutral result.
    • 
        


        
Rolling out DMARC without losing mail

        
Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com first. Aggregate reports arrive daily as XML from each large mailbox provider and show every IP sending as your domain, with pass and fail counts. Fix or authorize the legitimate senders, then move to p=quarantine, optionally with pct=25 to ramp up, and finally p=reject. Once you reach quarantine or reject, spoofed mail using your exact domain stops landing in inboxes, and a BIMI logo becomes possible.

        
The checker also looks for MTA-STS (_mta-sts TXT), which forces TLS for mail sent to you, and BIMI (default._bimi TXT). Both are optional extras. If you need to inspect any other record, the DNS lookup tool shows the raw answers.


        
Frequently asked questions

        

          
What happens if my SPF record goes over 10 DNS lookups?
Receivers stop evaluating and return a PermError, which most treat the same as a failed SPF check. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside the includes you reference.

          
Should I use ~all or -all?
Once DMARC is enforcing, the difference is small because DMARC makes the final call. ~all (soft fail) is the safer choice while you are still discovering senders. -all is fine when you are confident the list is complete. Never use +all.

          
Why can this tool not find my DKIM record?
DKIM keys live at selector._domainkey.yourdomain, and DNS offers no way to list selectors. If yours is not one of the common names, open a raw email header from your domain, find the DKIM-Signature line and copy the s= value into the selector box.

          
Is p=none good enough for Gmail and Yahoo?
For bulk senders, Google and Yahoo require a DMARC record, and p=none satisfies the minimum. It does not protect your domain from spoofing though. Use the reports to fix your senders, then move to quarantine and finally reject.