Free tool

SPF & DMARC checker

Inspect a domain's sending policies. The raw TXT records are fetched and parsed, and every gap that would hurt deliverability is listed.

Try one:

About this tool

What SPF and DMARC do

SPF (Sender Policy Framework) is a TXT record at your domain that lists the servers allowed to send mail using your domain in the envelope sender. A receiving server looks it up, checks whether the connecting IP is on the list, and applies the record's final mechanism: -all (reject others), ~all (soft fail, treat with suspicion) or ?all (no opinion). DMARC builds on SPF and DKIM: a TXT record at _dmarc.yourdomain.com tells receivers what to do when a message fails authentication or its From domain does not align (p=none to monitor, p=quarantine to spam-folder, p=reject to refuse), what share of mail the policy applies to (pct) and where to send aggregate reports (rua). Since February 2024, Gmail and Yahoo require anyone sending 5,000 or more messages a day to publish SPF, DKIM and a DMARC record, and to pass alignment.

What this tool checks

The checker fetches every TXT record at the domain and at _dmarc, with bounded lookups so a slow resolver cannot stall the page, and shows the raw records exactly as published. For SPF it counts include mechanisms and DNS-querying terms (SPF permits ten; more causes a permanent error at receivers), identifies the all mechanism, and warns when more than one SPF record exists, which RFC 7208 treats as a failure. For DMARC it parses the policy, subdomain policy, pct and rua address. The gaps list translates all of this into actions: add a DMARC record, move from p=none once reports look clean, replace +all, add a rua address, cover 100% of mail.

What it cannot check

DKIM. A DKIM public key lives at selector._domainkey.domain, and the selector is private to your sending platform, so it cannot be discovered from the domain alone. Check DKIM from the authentication page of your email provider or sending tool. The tool also cannot see whether your actual mail aligns with these records; for that, read the DMARC aggregate reports that a rua address collects.

A domain can receive mail perfectly well with no SPF or DMARC. These records describe the domain as a sender, which is why Verifyre shows them as deliverability insights on every result rather than using them to judge whether an address is deliverable.

FAQ