SPF and DMARC record checker
Paste a record and see what it actually does. Runs in your browser — nothing is sent anywhere.
Detected: DMARC record
How to read the result
This parses the record you paste. It does not perform a live DNS lookup, so it validates syntax and policy rather than confirming what is published on your domain right now. Retrieve the record with a DNS query first, then paste the full TXT value here.
The two findings worth acting on immediately are an SPF record over ten DNS lookups, which fails authentication outright, and a DMARC record with no rua address, which leaves you blind to who is sending as your domain.
Common questions
Why does the SPF lookup limit matter so much?
Exceeding ten lookups returns a permanent error, and receivers treat that as an SPF failure. Adding one more vendor to a near-limit record can break authentication for all your mail at once.
Should I go straight to p=reject?
No. Start at p=none, read aggregate reports for at least two weeks to find every legitimate sender, then move to quarantine and finally reject.
Does this check my live DNS?
No. It analyses the text you paste, entirely in your browser.
Authentication checked before every send
The compliance gate verifies SPF, DKIM and DMARC as part of pre-flight.