Free · no account required

SPF and DMARC checker

Look up the SPF, DMARC, MTA-STS and CAA records of a domain online and see how each one is rated. Enter the domain you send mail from, for example example.com rather than www.example.com.

No signup No destructive traffic Public website checks

Record reference

What each record does and how it is rated

The checker reads these records on the hostname you enter. Missing SPF, DMARC and MTA-STS records are flagged only when the host has MX records, because a host that receives no mail does not need them in the same way.

Record	Where it is published	What good looks like	How this checker rates it
`MX`	MX records on the hostname.	Present on domains that receive mail.	Counted and shown; never a finding on its own.
`SPF`	A TXT record starting v=spf1 on the hostname.	Exactly one SPF record that lists every service sending mail for the domain.	Missing while the host has MX records: medium. The record text is shown.
SPF all mechanism	The last term of the SPF record.	-all or ~all.	+all: high. ?all: low. -all and ~all raise nothing.
SPF DNS lookups	The include, a, mx, ptr, exists and redirect terms of the record.	At most ten terms that need a DNS lookup.	More than ten in the top-level record: medium. include: targets are not expanded, so nested lookups are not counted.
`DMARC`	A TXT record starting v=DMARC1 at _dmarc.example.com for example.com.	p=quarantine or p=reject once reports show that all legitimate mail passes.	Missing while the host has MX records: medium. p=none: low. quarantine or reject: passed. sp, pct, rua and alignment are not evaluated. On a subdomain, receivers also apply the organizational domain’s DMARC policy, which this check does not read.
`MTA-STS`	A TXT record starting v=STSv1 at _mta-sts.example.com, plus a policy file on the mta-sts host.	Both the record and the policy file, in enforce mode once tested.	Missing record while the host has MX records: low. Only the DNS record is checked; the policy file is not fetched.
`CAA`	CAA records on the hostname.	Records that name only the certificate authorities you use.	Any CAA record: passed. None: low. The contents are not compared with your certificate. On a subdomain, certificate authorities also honour the parent domain’s CAA, which this check does not read.
`DKIM`	TXT records at selector._domainkey.example.com.	A key for each service that signs your mail.	Not checked: selector names cannot be discovered from DNS alone.

TLS reporting, DNSSEC and BIMI are not checked.

How to fix

How to fix common SPF and DMARC findings

Change one record at a time and give DNS time to update before you check again. The examples use example.com and placeholder services; replace them with your domain and the services that really send your mail.

Publish DMARC in monitoring mode

Add one TXT record at _dmarc on the domain in your From address. p=none does not change delivery, and rua asks receivers for aggregate reports that show which servers send mail as your domain and whether they pass SPF or DKIM in alignment. If the reports go to another domain, that domain must publish a record that authorizes them.

; DMARC record for example.com, monitoring only
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

; Only if rua points to another domain, for example rua=mailto:reports@example.net,
; example.net publishes:
example.com._report._dmarc.example.net.  TXT  "v=DMARC1"

Move to quarantine, then reject

When the reports show every legitimate source passing, switch to p=quarantine, watch the reports again, then move to p=reject. RFC 7489 offered pct to apply the policy to part of the failing mail. RFC 9989, which replaces it, drops pct because partial values were applied unevenly, and adds t=y, which asks receivers to apply one level below the published policy. Receivers that still follow RFC 7489 ignore t=y, so add pct=0 while testing: it asks them for the same one-level-lower handling. Remove both tags to enforce.

; Publish one version at a time, in this order, after p=none
; 1. Quarantine in test mode (t=y, plus pct=0 for RFC 7489 receivers), then in full
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; t=y; pct=0; rua=mailto:dmarc-reports@example.com"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"
; 2. Reject in test mode, then in full
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; t=y; pct=0; rua=mailto:dmarc-reports@example.com"
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Keep one SPF record per domain

A name may carry only one TXT record that starts with v=spf1; two make SPF fail with a permanent error. Merge every sender into one record. include: checks a provider's own record, and redirect= hands the whole policy to another domain, which helps when several domains share one policy. redirect= is ignored when the record also contains an all term.

; Before: two SPF records on one name (permerror)
example.com.  TXT  "v=spf1 include:_spf.mailhost.example ~all"
example.com.  TXT  "v=spf1 include:spf.newsletter.example ~all"

; After: one record
example.com.  TXT  "v=spf1 include:_spf.mailhost.example include:spf.newsletter.example ~all"

; Another domain that uses the same policy
example.org.  TXT  "v=spf1 redirect=example.com"

Stay within ten DNS lookups

SPF allows at most ten terms that need a DNS lookup, counted across every nested include: include, a, mx, ptr, exists and redirect. One more and SPF fails with a permanent error. Remove includes for services you no longer use, replace a and mx with ip4 or ip6 ranges you control, drop ptr, and move a bulk sender to a subdomain with its own SPF record. Copying a provider's addresses into your record also saves lookups, but the copy goes stale when the provider changes them. This checker counts only the top-level terms.

; One lookup each: include, a, mx, ptr, exists, redirect (plus every lookup inside an include)
; No lookup: ip4, ip6, all

; Before: 4 lookups in the top-level record alone
example.com.       TXT  "v=spf1 a mx include:_spf.mailhost.example include:spf.oldtool.example ~all"

; After: fixed address, unused service removed, bulk mail on its own subdomain
example.com.       TXT  "v=spf1 ip4:192.0.2.10 include:_spf.mailhost.example ~all"
news.example.com.  TXT  "v=spf1 include:spf.newsletter.example ~all"

Choose ~all or -all with care

End the record with ~all (softfail) or -all (fail), never with +all, which lets any server pass. -all is the stricter signal, but a receiver that checks SPF early can then reject forwarded mail before DMARC sees its valid DKIM signature. With an enforced DMARC policy, ~all leaves the decision to DMARC. A domain that sends no mail can publish v=spf1 -all.

; Choose one ending for example.com, not both
example.com.  TXT  "v=spf1 include:_spf.mailhost.example ~all"
example.com.  TXT  "v=spf1 include:_spf.mailhost.example -all"

; A domain that sends no mail
example.net.  TXT  "v=spf1 -all"

Align DKIM with your From domain

DMARC passes when SPF or DKIM passes for a domain aligned with the From address. Many services sign with their own domain by default, which passes DKIM but not alignment. Turn on signing with your own domain in each service, so the signature carries d=example.com, and publish the key or CNAME the service gives you under its selector. Relaxed alignment, the default, accepts any subdomain of the same organizational domain; adkim=s and aspf=s require an exact match.

; Key for a sending service, selector s1: a CNAME or a TXT record, as the service says
s1._domainkey.example.com.  CNAME  s1.dkim.mailhost.example.
s1._domainkey.example.com.  TXT    "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."

; Aligned signature in a delivered message: d= matches the From domain
From: news@example.com
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...

A DNS change can take as long as the old record's TTL to reach every resolver. Then run the checker again on the domain in your From address, because it reads the exact hostname you enter.

Reading the result

How to read each status.

01PassedThe record was found and meets the check.
02Low · Medium · HighA record is missing or set in a way this check flags. The level is the same one the full snapshot uses.
03ObservedA record was recorded, but the check produced neither a pass nor a finding.
04Nothing observedThe check ran but found no record to show.
05Not applicableThe check does not apply, for example SPF or DMARC when the host has no MX records.
06Not measuredThe DNS lookup failed, so the check is not counted as passed.

Scope

What this checker does not do.

01It reads records on the exact hostname you enter. For www.example.com it queries www.example.com and _dmarc.www.example.com, not example.com.
02The hostname must resolve to an address. A mail-only domain without an A or AAAA record gets no result here.
03It does not check DKIM, TLS reporting or DNSSEC, and it does not expand SPF include: terms.
04Mail records are read from public DNS only, and no mail is sent. The same run also makes a few ordinary requests to the home page for the other seven checks. It is not a deliverability test, a vulnerability scan or a penetration test.
05The result is a point-in-time view; DNS changes can take time to reach every resolver.

FAQ

Questions about the SPF and DMARC check.

Why does www.example.com show no SPF record?

The checker reads the exact hostname. Mail records usually sit on the domain you send mail from, so enter example.com itself.

Is p=none wrong?

p=none is monitoring mode. It is a normal first step while you read DMARC reports, so it is rated low. Move to quarantine or reject once all legitimate mail passes.

Why is DKIM not checked?

DKIM keys are published under selector names that only the sending services know, so they cannot be found from DNS alone. Check them in the settings of each service that sends your mail.

Does this test whether my mail reaches the inbox?

No. Mail records are read from public DNS only, and no mail is sent; the same run also makes a few ordinary requests to the home page for the other checks. It is not a vulnerability scan or a penetration test. Inbox placement also depends on the sending service, its reputation and each message.

Can a domain have two SPF records?

No. When a name has more than one TXT record that starts with v=spf1, SPF returns a permanent error for every message. Merge the mechanisms into one record; a long record can be split into several quoted strings within that record, which receivers join without adding spaces.

Why does DMARC fail when SPF passes?

SPF checks the envelope sender, often a bounce domain of your mail service, not the domain in your From address. That pass counts for DMARC only when the two domains align. In each service, set up DKIM signing with your own domain, or a custom envelope sender on one of your subdomains.

How long should I stay at p=none?

Until the aggregate reports show every legitimate source passing with an aligned domain, including mail that goes out only once a month, such as invoices. For domains whose users post to mailing lists, RFC 9989 advises against reject; if you still choose it, spend at least a month at none and as long again at quarantine first.

Next step