SPF & DMARC Checker

SPF is a DNS record listing the servers allowed to send mail for your domain. DMARC is a second record that tells receivers what to do when a message fails SPF or DKIM, and where to send reports about it. SPF on its own does not stop spoofing of the From address people see; DMARC is what connects the check to that address and gives it consequences.

RFC 7208 limits an SPF evaluation to 10 DNS lookups. Every include, a, mx, exists and redirect term costs one, and an include can contain more lookups of its own. Over 10, receivers return a permanent error and treat SPF as failed. This checker counts the lookups in your top-level record; nested includes add to that total, so a count near 10 here is a warning sign.

"-all" (hard fail) tells receivers to reject mail from servers you have not listed, and is the strongest setting. "~all" (soft fail) accepts that mail but marks it suspicious, and is a common setting while you confirm every legitimate sender is listed. Never use "+all" or a bare "all": both authorise every server on the internet.

No. p=none asks receivers to take no action on mail that fails DMARC; it exists so you can collect reports before enforcing. It is the most common way a domain looks protected and is not. Move to p=quarantine, then p=reject, once your reports show your legitimate mail passes.

No. DKIM keys are published under selectors that are different for every sending service and cannot be listed from DNS alone. On Enterprise, DNS Spy's Security Center checks DKIM on monitored domains, using the DKIM records found for each domain and the selectors the major mail providers publish.

No. DNS Spy is not a DMARC report aggregator. It checks your SPF and DMARC configuration, continuously, on every domain you monitor, and alerts you when a record changes or a check that was passing starts failing.