SPF & DMARC Record Checker

Paste your SPF, DMARC or DKIM record to find the mistakes that send your mail to spam, or build a correct record from a form.

Runs on your devicenothing is uploadedHow to check

TXT records Your domain (optional: checks report addresses and fills in the lookup commands)

Build a DMARC record

Mail that fails DMARC Subdomains Send daily reports to Send failure reports to (optional; few providers send them)

Apply to % of failing mail DKIM alignment SPF alignment Failure reports when

DMARC record — TXT at host _dmarc

Guide & FAQWhat each record does · The mistakes that break SPF · Rolling out DMARC without losing mail · What this page does not do · Frequently asked questions

What each record does

Record	Where it lives	What it says
SPF	TXT on the domain itself, starting `v=spf1`	Which servers may send mail for the domain in the envelope (the bounce address)
DKIM	TXT at `selector._domainkey.domain`	The public key that checks the signature your mail service adds to each message
DMARC	TXT at `_dmarc.domain`, starting `v=DMARC1`	What receivers should do when neither SPF nor DKIM passes for the From domain, and where to send reports

Gmail and Yahoo require all three from anyone sending more than 5,000 messages a day to them, and mail from small domains without them is far more likely to be filed as spam. DMARC is the one that protects your name: SPF and DKIM can both pass for someone else’s domain while they put yours in From.

The mistakes that break SPF

Mistake	What happens
Two `v=spf1` records, often one per service	permerror: receivers ignore SPF for the domain. Merge them into one record with every include.
More than 10 DNS lookups	permerror. Every `include`, `a`, `mx`, `ptr`, `exists` and `redirect` costs one, and so does each one inside the included records. Google Workspace alone uses several.
A typo such as `ipv4:` or `inlcude:`	permerror for the whole record, not just that term.
Terms after `all`	Never read. Whatever was added at the end is not authorised.
`+all` or `?all`	Every server passes, or nothing is decided. The record protects nothing.

Rolling out DMARC without losing mail

Start with p=none and a rua address. Receivers send a daily XML report of every server that sent mail with your domain in From, and whether SPF and DKIM passed. When the reports show only your own services, all passing, move to p=quarantine, then to p=reject. A newsletter tool or a shop that you forgot about shows up in those reports before its mail starts going missing.

If the report address is at another domain (a report service, or your agency), that domain has to publish a record saying it accepts reports for yours. The checker gives the exact name when you fill in your domain.

What this page does not do

It does not query DNS. It checks the text you paste, so it cannot follow an include to count the lookups inside it, or confirm that the record is actually published. Its security policy does not let it contact other sites at all. To see what is published right now, run the commands listed under the results and paste their output. To see whether a message you sent passed, open it at the receiving end and read its headers with the email header analyzer.

Frequently asked questions

Is the SPF record I paste sent anywhere?

No. The SPF, DMARC and DKIM records are checked by the script on this page, in your browser, and the page’s security policy does not allow it to contact any other site. You can check that on the privacy page.

Why can this checker not count all the SPF lookups?

Counting every SPF lookup means fetching each included record from DNS, and this page does not make network requests. It counts the lookups in the record you paste and marks the result as "at least" when there are includes. To get the full count, paste the included records too, or use a DNS-based tester once the record is published.

Should an SPF record end in ~all or -all?

Start an SPF record with ~all (soft fail) while you are still finding every service that sends for you, then switch to -all. With DMARC in place most receivers act on the DMARC policy rather than on the SPF ending, so ~all is a common permanent choice too. Avoid ?all and +all.

Can a domain have two SPF records?

No. A domain may publish only one SPF record. With two v=spf1 records, receivers return permerror and ignore SPF altogether. Merge them into one record that lists every include, followed by a single all at the end.

How do I find my DKIM selector?

The DKIM selector is the s= value in the DKIM-Signature header of a message you sent. Send yourself a message, open its headers (the email header analyzer on this site lists them), and look up selector._domainkey.yourdomain as a TXT record. Google Workspace uses google by default, Microsoft 365 selector1 and selector2.