עב
עב

SPF, DKIM and DMARC checker

Before your mail lands in spam, check what receivers read in DNS: one valid SPF record within its 10 lookups, a DMARC policy that does something, and DKIM keys that are long enough. Your browser asks public resolvers directly; nothing goes through or stays with ANAROQ. Below the check, write SPF and DMARC records locally.

The domain in your From address, for example example.com.
The s= value of the DKIM-Signature header of a message you sent, for example google or s1. Several are separated by commas.

What leaves your browser

When you press Check e-mail DNS, your browser sends DNS queries for the domain you entered, its _dmarc name, the DKIM selector names you entered and the names its SPF record includes, directly to Cloudflare 1.1.1.1, and to Google Public DNS only for a query Cloudflare 1.1.1.1 does not answer. Like any request, they also see your IP address. Nothing is sent before you press the button.

The names are not sent to ANAROQ, not stored, not put in the link and not sent to analytics. The generators below send nothing.

Write SPF and DMARC records

These generators run in your browser and send nothing. Publish the result at your DNS provider as a TXT record, then check again above.

SPF record

Choose everything that sends mail as your domain. A domain has exactly one SPF record: if you already have one, merge it rather than adding a second.

Sending servicesExamples in alphabetical order, not a recommendation. Each include is the one in the linked documentation, checked on 2026-10-18; the documentation wins if it changes.
Your own servers
Addresses or ranges of servers that send, for example 203.0.113.10 or 198.51.100.0/24.
For example 2001:db8::25 or 2001:db8::/48.
Mail from any other server
TXT record at @ (the domain itself)
v=spf1 -all

Nothing chosen: this is the record of a domain that sends no mail. It costs no lookup.

DMARC record, step by step

DMARC tells receivers what to do with mail that fails both SPF and DKIM alignment, and where to send reports. Move one step at a time, and only when the reports show that all your own mail passes.

Stage
A mailbox for aggregate reports, for example [email protected]. A mailbox at another domain must be authorized by that domain.
TXT record at _dmarc
v=DMARC1; p=none

Next: read the reports, add the services that fail to SPF or DKIM, then move to quarantine.

What it does

It reads the e-mail authentication records of a domain from public DNS-over-HTTPS resolvers, from your browser: the SPF record and every record it includes, the DMARC policy, the DKIM keys of the selectors you enter, and the MX records. It reports what makes receivers treat your mail as unauthenticated: more than one SPF record, more than 10 DNS lookups, +all, a missing or monitoring-only DMARC policy, missing or short DKIM keys. Two generators write SPF and DMARC records locally.

How it works

  1. Enter the domain of your From address, and the DKIM selectors you know (the s= value of the DKIM-Signature header of a message you sent).
  2. Read the notice: pressing the button sends the DNS names of the check to the resolvers listed there.
  3. Press Check e-mail DNS. The SPF includes are followed one level at a time, so a check takes a few seconds.
  4. Read the findings, most serious first, each with what to change and the RFC behind it. Use the generators below to write a fixed record.

What it checks

SPF
Exactly one record that starts with v=spf1, with valid terms; its include and redirect targets followed and every lookup counted against the limit of 10 (RFC 7208 §4.6.4); what all says about other servers (+all, ?all, ~all, -all); ptr and terms after all.
DMARC
One record at _dmarc of the domain, or of its parent domain; a valid p, and sp, pct, rua, adkim and aspf; p=none is reported as monitoring only, and missing reports as a gap (RFC 7489).
DKIM
For each selector you enter: whether a key is published, whether it is valid, revoked or in testing mode, and its size. RSA under 1024 bits is refused; under 2048 is below what signers should use (RFC 8301).
MX
The mail servers and their order; a domain without MX, a null MX (RFC 7505), and an MX that points to an IP address.

Example

example.com added a newsletter and a CRM service to its SPF record. These made-up answers (documentation names and addresses) are the checker's real findings: the includes now need 11 DNS lookups, DMARC is still p=none without reports, and the DKIM key of selector s1 is 1024 bits.

Result for example.com

SPF

v=spf1 a mx include:spf.mail-a.example include:spf.newsletter.example include:spf.crm.example ~all

11 of 10 DNS lookups allowed, with the includes.

Include tree
  • example.com 5 lookups
    • include:spf.mail-a.example 3 lookups
      • include:_s1.mail-a.example 0 lookups
      • include:_s2.mail-a.example 0 lookups
      • include:_s3.mail-a.example 0 lookups
    • include:spf.newsletter.example 2 lookups
      • include:_ip.newsletter.example 0 lookups
    • include:spf.crm.example 1 lookups

DMARC

v=DMARC1; p=none

Found at _dmarc.example.com.

TagMeaningValue
pPolicy for the domainnone
spPolicy for subdomainsnone
pctShare of failing mail the policy applies to (%)100
ruaWhere aggregate reports go—
adkimDKIM alignment (r relaxed, s strict)r
aspfSPF alignment (r relaxed, s strict)r

DKIM

SelectorStatusKey
s1._domainkey.example.comPublishedrsa, 1024 bits

MX

PreferenceMail server
10mx1.example.com
20mx2.example.com

Findings

Error1
High0
Medium2
Low1
Info1

5 findings: 1 error, 0 high, 2 medium, 1 low, 1 info.

Error1

  1. ErrorAQ-MAIL-005

    The SPF record needs 11 DNS lookups, with its includes; the limit is 10. Past it, receivers stop with an error (permerror) and SPF fails for all your mail.

    Fix: Remove includes of services you no longer send with, replace a and mx with ip4:/ip6: of fixed servers (they cost no lookup), or send bulk mail from a subdomain with its own SPF record.

    Source

Medium2

  1. MediumAQ-MAIL-023

    The DMARC policy at _dmarc.example.com is p=none: monitoring only. Mail that fails SPF and DKIM is still delivered.

    Fix: Once the reports show that all your own mail passes, move to p=quarantine and then to p=reject. The generator below explains each step.

    Source

  2. MediumAQ-MAIL-034

    The DKIM key of selector s1 is RSA with 1024 bits. Keys under 1024 bits are refused; signers should use at least 2048.

    Fix: Create a 2048-bit key in your mail service under a new selector, publish it, switch signing to it, and remove the old selector after a few days.

    Source

Low1

  1. LowAQ-MAIL-025

    The DMARC record at _dmarc.example.com has no rua address: nobody receives the aggregate reports that show who sends mail as this domain.

    Fix: Add rua=mailto: with a mailbox that you read, or one of a DMARC report service.

    Source

Info1

  1. InfoAQ-MAIL-011

    The SPF record ends with ~all (soft fail): mail from other servers is marked, not refused. With a DMARC policy this is common; -all is stricter.

    Source

Limits

  • It sees what public resolvers answer from where you are, at this moment.
  • DKIM selectors cannot be discovered from DNS: only the ones you enter are checked.
  • SPF includes that use macros (%{…}) are filled in per message and are not followed, so the lookup count can be higher. The checker stops following includes once the count passes 10.
  • It does not send a test message, check blocklists or read BIMI, and it cannot say whether a given message passes: that depends on the server it came from.
  • Whether a name is a root domain is decided without the Public Suffix List, as in the DNS go-live checker; the parent domain for DMARC follows the same rule.

Methodology: how the numbers are worked out

Sources

  1. RFC 7208: Sender Policy Framework (SPF)
  2. RFC 7208 §4.6.4: DNS lookup limits
  3. RFC 7489: DMARC
  4. RFC 6376: DKIM signatures
  5. RFC 8301: cryptographic algorithm and key usage update to DKIM
  6. RFC 8463: Ed25519 for DKIM
  7. RFC 7505: null MX
  8. RFC 8484: DNS queries over HTTPS (DoH)

Updated

Next step

DNS go-live checker

A free public tool by ANAROQ, a company building compute infrastructure. What ANAROQ is building