SPF & DMARC Checker

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receiving mail servers what to do when an email fails SPF or DKIM checks — either monitor (none), quarantine to spam, or reject it outright. DMARC also enables reporting so you can see who is sending email from your domain. Without DMARC, even a correctly configured SPF record provides limited protection against phishing.

A DMARC policy of p=none means the record is in monitoring mode only. Emails that fail authentication are still delivered normally, but reports are sent to the address in the "rua" tag. This is a good starting point to understand your email sending patterns, but it provides no protection. You should aim to progress to p=quarantine and eventually p=reject once you are confident all legitimate email is passing.

Log in to your domain registrar or DNS provider and add a TXT record at your root domain (@). The value should be something like "v=spf1 include:yourmailprovider.com -all". Replace "yourmailprovider.com" with the include provided by your email service (e.g., Google Workspace uses include:_spf.google.com). The "-all" at the end means reject all other senders. Once added, changes propagate within minutes to 48 hours.

The "~all" (softfail) mechanism means that emails from unlisted servers should be accepted but marked as suspicious. The "-all" (hardfail) mechanism instructs receiving servers to reject emails from unlisted servers outright. For maximum protection, use "-all". Use "~all" only if you are transitioning and need time to identify all your legitimate sending servers first.