What This Checker Looks At
Two DNS records decide whether someone else can send email that claims to be from your domain, and whether your own mail gets trusted:
- SPF, the TXT record on the domain that lists who may send for it, and how strictly to treat everyone else (the
-allor~allat the end). - SPF lookups. A count of the DNS lookups at the top level of your SPF record, so you can spot when you're close to the limit of 10.
- DMARC, the TXT record at
_dmarcthat sets the policy (none, quarantine or reject), how much mail it applies to, and where reports go. - Inherited DMARC. For a subdomain without its own record, the parent domain's policy is shown, the way receivers apply it.
- MX records. Whether the domain receives mail at all.
How to Read the Result
"Protected" means a receiving server that follows DMARC will quarantine or reject mail pretending to be you. Gmail and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024, and Microsoft followed for Outlook.com in 2025, so a missing record now affects your own deliverability too, not just spoofing.
Common Mistakes and the Fix
Two SPF records. A domain may only have one TXT record starting with v=spf1. Two of them is a permanent error and SPF fails for everything. Merge them into one.
Over 10 lookups. Each include: for a mail provider, CRM or newsletter tool adds lookups, and their own includes count too. Remove senders you've stopped using before reaching for SPF "flattening" tools.
DMARC stuck on p=none. Very common, and it means spoofed mail still gets delivered. Set rua=, read a few weeks of reports, make sure every real sender passes, then step up to p=quarantine and finally p=reject.
Parked domains left open. Domains you own but don't mail from are favorite targets. Give each one v=spf1 -all and v=DMARC1; p=reject.
SPF & DMARC FAQ
What is an SPF record?
A DNS TXT record starting with v=spf1 that lists which servers are allowed to send email for your domain. Receiving servers check it, and the ending (-all, ~all) tells them what to do with mail from anywhere else.
What is DMARC?
A DNS TXT record at _dmarc.yourdomain.com that tells receiving servers what to do when a message claiming to be from you fails SPF and DKIM checks: nothing (p=none), send to spam (p=quarantine), or block it (p=reject). It can also ask them to send you reports.
Should I use -all or ~all in SPF?
With DMARC in place, ~all (softfail) is common and safe, because DMARC makes the final decision. -all (hardfail) is stricter. What you should never use is +all, which tells the world any server may send as you.
Is p=none good enough?
It's a starting point, not protection. p=none only collects reports. Spoofed mail is still delivered. Once your reports show your real senders passing, move to quarantine, then reject.
Do I need DMARC if I don't send email from my domain?
Yes, especially then. A domain that never sends mail is easy to spoof. Publish v=spf1 -all and a DMARC record with p=reject, and receiving servers will drop anything pretending to be you.
Why isn't DKIM checked here?
DKIM keys live at a selector name (like google._domainkey.example.com) that only the sending service knows, so they can't be found reliably from the outside. Check DKIM in your email provider's admin console, or in the DMARC reports you get once rua is set.
What is the SPF 10-lookup limit?
SPF evaluation may trigger at most 10 DNS lookups (include, a, mx, ptr, exists, redirect). Go over and SPF returns a permanent error, which can fail mail you meant to send. Every include of a big provider can add several lookups of its own.