Skip to content
Free tool

SPF and DMARC record checker

Paste a record and see what it actually does. Runs in your browser — nothing is sent anywhere.

Detected: DMARC record

!p=none monitors without enforcing. Correct for the first two weeks, but it leaves your domain spoofable if you stay there.
Aggregate reporting is on via rua=.

How to read the result

This parses the record you paste. It does not perform a live DNS lookup, so it validates syntax and policy rather than confirming what is published on your domain right now. Retrieve the record with a DNS query first, then paste the full TXT value here.

The two findings worth acting on immediately are an SPF record over ten DNS lookups, which fails authentication outright, and a DMARC record with no rua address, which leaves you blind to who is sending as your domain.

Common questions

Why does the SPF lookup limit matter so much?

Exceeding ten lookups returns a permanent error, and receivers treat that as an SPF failure. Adding one more vendor to a near-limit record can break authentication for all your mail at once.

Should I go straight to p=reject?

No. Start at p=none, read aggregate reports for at least two weeks to find every legitimate sender, then move to quarantine and finally reject.

Does this check my live DNS?

No. It analyses the text you paste, entirely in your browser.

Authentication checked before every send

The compliance gate verifies SPF, DKIM and DMARC as part of pre-flight.