DMARC and SPF Checker: Can Someone Send Email as You?
Checks a domain's SPF record against the limit of 10 DNS lookups, its DMARC policy, and DKIM on the common selectors. Then the builders below write the records to add.
SPF Record Builder
Tick every service that sends email as your domain: your mailboxes, your newsletter tool, your website's contact forms and your app's notifications.
v=spf1 include:_spf.google.com ~all
Replace any SPF record that's already there. A domain must have only one. Mailchimp's newsletter sending and many CRMs don't need an SPF entry; they ask you to add a DKIM record instead.
DMARC Record Builder
Start at none, read the reports for a few weeks, then tighten. The reports are XML files sent daily; a free DMARC report service makes them readable.
v=DMARC1; p=none
Monitoring only: nothing is blocked yet. Add a report address so you can see who sends as your domain.
Getting to P=reject Without Losing Mail
1. List every sender. Your mailboxes, the newsletter tool, the CRM, invoices from the accounts package, the website's contact form, your app's password resets. Each one needs to pass SPF or DKIM for your domain.
2. Publish p=none with a report address. Within a day the reports start arriving, and they show every server sending as your domain, including the ones you forgot.
3. Fix what fails. Usually a service needs its DKIM record adding, or the website sends through the server's own mail instead of a proper sending service.
4. Tighten in steps. p=quarantine first, then p=reject once the reports are clean. After that, spoofed mail claiming to be from you is refused outright.
Do the same for domains that send no email at all: v=spf1 -all and p=reject, so nobody can use them either.
Questions
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM signs each message so the receiver can tell it came from an allowed sender and wasn't changed. DMARC ties the two to the address people see in the From line, tells receivers what to do when a message fails, and sends you reports.
Do I need DMARC?
Yes, if the domain sends any email. Since 2024, Gmail and Yahoo require SPF, DKIM and a DMARC record from anyone sending in bulk, and mail without them is more likely to land in spam for everyone else too. Without DMARC, anyone can send email that appears to come from your domain.
What DMARC policy should I use?
Start with p=none and a report address, so you can see every service that sends as your domain. Once the reports show only your own services, all passing, move to p=quarantine, then p=reject. Going straight to reject risks blocking your own invoices or newsletters.
What does "too many DNS lookups" mean for SPF?
An SPF check may make at most 10 DNS lookups, counting every include:, a, mx and redirect, and the includes inside those. Past 10, receivers treat SPF as failed, so mail from every service in the record can go to spam. Remove services you no longer use, or replace includes with the IP ranges they stand for.
Should SPF end in ~all or -all?
Either is fine once DMARC is in place, as DMARC decides what happens to failing mail. ~all (soft fail) is the more common choice, as it is safer while you find every service that sends for you. Never use +all, which allows any server to send as you.
Can I have two SPF records?
No. A domain must have exactly one, or receivers treat SPF as broken. If two services each told you to add a record, merge them into one: v=spf1 include:first include:second ~all.
Why does the checker say it can't find DKIM?
DKIM keys live at a name made of a selector, which can be anything the email service chose. The checker tries the common ones (Google, Microsoft 365, Fastmail, Zoho and others). If yours uses another, it won't be found from outside: check your provider's settings instead.
What should a domain that sends no email have?
v=spf1 -all as its SPF record and v=DMARC1; p=reject as its DMARC record. That tells every receiver that any email claiming to come from it is fake. Parked and redirect-only domains are a favourite for spoofing because nobody watches them.
Mail Going to Spam, or a DMARC Rollout Stalled?
I set up SPF, DKIM and DMARC for agencies and software teams, read the reports, and get domains to p=reject without losing mail.