SPF and DMARC Checker: Test Your Domain's Mail Records

How to use it

Type your domain in Domain, for example example.com.
If you know it, add the DKIM selector from a signed message, such as google or selector1. Leave it empty if you do not.
Press Check domain. In SPF record, the DNS lookups count must stay at 10 or less.
Read DMARC policy. none only monitors; quarantine and reject act on mail that fails.

What SPF checks

SPF (RFC 7208) lists the servers that may send mail for a domain, in a TXT record. A receiver takes the domain of the sender, reads its SPF record and checks the sending server against each term from left to right. The first term that matches decides the result, by its qualifier: + passes (the default when none is written), - fails, ~ is a soft fail and ? is neutral.

include, a, mx, ptr, exists and redirect each cost one DNS lookup, and the lookups of an included record count too. Receivers stop after 10 and treat the result as an error, so a large mail setup can break SPF without anyone noticing.
ip4 and ip6 cost no lookup. A provider that publishes its address ranges can be written in them.
Two SPF records on one name are an error (RFC 7208, section 4.5), and ptr is discouraged (section 5.5).

What DMARC does

DMARC (RFC 7489) tells receivers what to do with mail that fails the checks for your domain, and where to send reports. It is a TXT record at _dmarc followed by your domain, made of tags separated by semicolons: p is the policy, sp the policy for subdomains, pct the share of failing mail the policy applies to, rua the address for aggregate reports, and adkim and aspf the alignment, r for relaxed and s for strict.

This tool reads the record at _dmarc followed by the domain you type. Receivers that find no record there also look at the organizational domain, which this tool does not work out.

DKIM keys

DKIM signs each message with a key that is published in DNS under a selector, at selector followed by ._domainkey and your domain (RFC 6376, section 3.6.1). The page reads the key type and the size of an RSA key from its public key. An empty key means the key has been revoked. Ed25519 keys (RFC 8463) have a fixed size of 256 bits.

What this checker does not do

It does not send mail or test a real message, so it cannot say whether your mail passes.
It does not expand macros such as %{d}, so a record that uses them may give a different lookup count from a receiver's.
It does not work out the organizational domain for DMARC, and it does not check lookups that return nothing.

Example: one domain's SPF and DMARC records

The SPF record v=spf1 +mx a:colo.example.com/28 -all lets the domain's mail servers, and the addresses of colo.example.com within a /28 network, send its mail. Every other sender fails (-all). The record costs two DNS lookups, mx and a.

The DMARC record v=DMARC1; p=reject; rua=mailto:[email protected] asks receivers to reject mail that fails the checks and to send aggregate reports to [email protected].

Check	Result
DNS lookups in SPF	2
Policy (p)	reject
Reports (rua)	[email protected]

Frequently asked questions

Is an SPF record enough to stop spoofed mail?

No. SPF checks the server that sent a message, not the name the reader sees in the From line. Pair it with DKIM and a DMARC policy above p=none.

Why does my SPF record fail with too many lookups?

Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and the records they lead to count too. When the total passes 10, receivers treat SPF as an error. Remove includes you no longer use, or use the ip4 and ip6 ranges your provider publishes, which cost no lookup.

What DMARC policy should I use?

Start with p=none and an rua address, read the reports for a few weeks, and check that your real mail passes. Then move to quarantine and, when the reports are clean, to reject.

What is a DKIM selector?

It is the name before ._domainkey in a DKIM record. Each sending service uses its own selector, and a signed message names it in the s= tag of its DKIM-Signature header. Open the headers of a message you sent to find it.

What does the key size mean?

For an RSA key it is the length of the modulus in bits, the usual way key sizes are written: 1024 or 2048. If a record was cut or damaged in copying, the key cannot be read and the page says so.

Does this checker send my domain to anyone?

Only the names it checks are sent to the DNS resolver you choose, as DNS questions. Nothing is stored by us, and the rest of the page stays in your browser.

Sources

Figures and text last checked on Tuesday, November 10, 2026.