SPF & DMARC Checker
See whether a domain has SPF and DMARC configured, and what policy they enforce against spoofed mail.
SPF
–Sender Policy Framework: lists which mail servers are allowed to send email for this domain.
–
DMARC
–Tells receiving mail servers what to do with messages that fail SPF/DKIM checks.
–
DKIM needs a provider-specific selector, so it's not shown here. Use the DKIM checker below.
This check is sent via DNS-over-HTTPS to Cloudflare, with Google and NextDNS as fallbacks.
Learn about SPF and DMARC
What each one actually does
SPF (Sender Policy Framework) publishes which mail servers are authorized to send email for a domain, so a receiving server can flag mail that claims to be from that domain but actually came from somewhere else. DMARC builds on SPF and DKIM by telling receivers what to do with mail that fails those checks: let it through, send it to spam, or reject it outright, and where to send reports about what happened.
Reading a DMARC policy
p=none means monitor and report only, with no effect on delivery. p=quarantine tells receivers to route failing mail to spam. p=reject tells them to refuse it outright. Most domains are meant to work up to reject gradually rather than starting there.
Common questions
I have SPF but no DMARC. Is that enough? Not really. SPF alone is fairly easy to work around since it doesn't tell a receiver what to actually do when a check fails. DMARC is what enforces an action and gives you visibility through reports, so the two together are what provide real protection.
Why am I getting a "too many DNS lookups" error on my SPF record? SPF has a hard limit of 10 DNS lookups per check under RFC 7208. This gets hit often when a domain includes several third-party senders, like a marketing platform, a CRM, and a mail provider all at once. The fix is usually flattening or trimming the includes.
Should I jump straight to p=reject? No. Standard practice is to start at p=none to collect reports and confirm every legitimate sender is actually covered, then move to quarantine, and only go to reject once you're confident nothing real will get blocked.