Why it matters
Since 2024, Google and Yahoo require bulk senders to have SPF, DKIM and DMARC set up, and mail without them is more likely to land in spam. The records are short but strict: one extra include can push SPF over its 10-lookup limit and break it silently.
This checker reads the records you paste (it makes no DNS lookups itself), explains every part, counts the lookup budget, tests a sending IP against the address ranges, and helps you move DMARC from monitoring to enforcement.
How it works
- InputYour domain's TXT records
- In your browserParsed and checked against the RFCs
- OutputIssues, lookup count and a DMARC record
Where it fits in a designer's workflow
- Plan
- Design
- Build
- Test
- Launch
By the numbers
Show the numbers as a table
| Mechanism | Costs a lookup |
|---|---|
| +ip4:203.0.113.0/24 | no |
| +ip6:2001:db8::/32 | no |
| +include:_spf.google.com | yes |
| +include:spf.protection.outlook.com | yes |
| +mx | yes |
| ~all | no |
How to use it
- Get your TXT records (dig TXT yourdomain, dig TXT _dmarc.yourdomain, dig TXT selector._domainkey.yourdomain).
- Paste each one into its box.
- Read the checks for each record.
- Build a stricter DMARC record when you're ready.
FAQ
Why doesn't it look the records up?
So nothing about your domain is sent anywhere. Copy the TXT records from your DNS provider or a dig command.
What's the SPF 10-lookup limit?
Receivers stop after 10 DNS lookups (include, a, mx, ptr, exists and redirect). Beyond that SPF fails, so flatten or remove includes.
Can it follow includes?
It counts them, but can't see inside them without DNS. Each provider's include usually costs 1 to 4 lookups.
When should I use p=reject?
After a few weeks at p=none with reports showing your real mail passes. Then step through quarantine to reject.
