SPF & DMARC Checker

What the SPF and DMARC checker does

Anyone can put your domain in the From line of an email. Three DNS records let receiving servers tell real messages from forgeries. SPF lists the servers allowed to send mail for your domain. DKIM publishes keys that verify a signature on each message. DMARC tells receivers what to do when a message fails those checks. This checker reads all three for a domain from our server in Newark, US, and explains what it finds.

It follows every SPF include down to the last record and counts the DNS lookups the way a receiving server does. It checks that report addresses on other domains have agreed to take your DMARC reports, and reads the records around email: MX, MTA-STS, TLS-RPT, BIMI and DNSSEC. Finally, it works out what would happen to a forged message claiming to be from you. We never send an email: the test follows your published records.

Use it when setting up email on a new domain, after adding a service that sends mail for you – a newsletter tool, a help desk or a billing system – or when genuine messages start landing in spam.

How to use the SPF and DMARC checker

1. Type your domain, or an email address: we use the part after the @.
2. Optionally add your DKIM selector if you know it (your email provider shows it). Separate several with commas.
3. Press Check and work through any problems, starting with the red ones. Where a record needs changing, we suggest one you can copy.

Understanding the results

Each check states its result in words: good, information, warning or problem. We count the findings; we don’t give a grade. For SPF, the closing all rule matters most: -all fails unlisted senders, ~all soft-fails them, ?all is neutral and +all lets anyone send as you. The lookup count shows how many of the 10 permitted DNS lookups your record uses, including those inside each include, and we warn from 8. A lookup that finds nothing is a void lookup, and more than two is also an error.

For DMARC, the policy tells receivers what to do with failing mail: none only monitors, quarantine sends it to spam and reject refuses it. Percentage shows how much failing mail the policy covers, and the rua address is where aggregate reports go. When that address is on another domain, the other domain must publish a record agreeing to receive them, and we check for it. For DKIM, each key found shows its selector, type and size. An empty key means it has been revoked.

The services listed as senders are recognised from their include and selector names. That’s our rule of thumb, not proof of who sends. MTA-STS asks other servers to deliver your mail only over encrypted connections, and TLS-RPT tells them where to report problems. BIMI publishes a logo that some inboxes show next to your messages; we don’t fetch the logo or check its certificate.

Questions