Free SPF, DKIM and DMARC Explainer
Paste an email authentication record to see what every term means, and which problems would hurt delivery or let spoofing through.
What is a SPF, DKIM and DMARC Explainer?
SPF, DKIM and DMARC are DNS records that prove email really comes from your domain. Gmail, Outlook and Yahoo now require them for bulk senders. This tool reads one of these records, explains every term, and flags the mistakes that send mail to spam or let others spoof you.
Each record type is checked against its RFC: SPF against RFC 7208, DKIM against RFC 6376 with Ed25519 from RFC 8463, and DMARC against RFC 7489. Problems that make a record invalid are errors; working but weak settings are findings ranked by severity.
Key Features
Every Term in Plain Language
Each mechanism, qualifier and tag is listed with what it does, from include and ~all to p=quarantine and adkim=s.
The SPF 10-Lookup Limit
Lookups from include, a, mx, exists, ptr and redirect are counted. Past 10, SPF fails for all mail, a common cause of sudden delivery trouble.
DKIM Key Strength From the Key
The RSA key size is read from the published key itself, so a 1024-bit key gets flagged even when the record doesn’t say.
DMARC Rollout Guidance
Monitor-only policies, partial pct values, weak subdomain policies and missing report addresses are flagged with the next step.
No DNS Queries, No Upload
You paste the record, and it’s checked in the browser. Nothing is looked up or sent, so it works for records you haven’t published yet.
Perfect for everyone
- Email administrators
- Marketers fixing deliverability
- IT teams setting up Google Workspace or Microsoft 365
- Developers configuring transactional email
How to Use the SPF, DKIM and DMARC Explainer
Pick the record type, paste the TXT value, and work through the findings.
Get the Record
Copy it from your DNS host, or look it up with dig TXT example.com, dig TXT selector._domainkey.example.com or dig TXT _dmarc.example.com.
Choose SPF, DKIM or DMARC
Pick the matching tab. If you paste a record of another kind, the tool says which tab to use.
Read the Terms
Each part of the record is listed with its meaning. Quoted strings from dig output are joined automatically.
Fix the Findings
High findings break authentication or allow spoofing; medium and low weaken it. Update the record at your DNS host and check again.
Email Authentication Records, Checked
Each answer is this tool’s output for the record on the left, in the tab named on the chip. Spot the weak setting before you reveal it.
“v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all”
“v=spf1 a mx ~all”
“v=spf1 +all”
“v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org include:spf.protection.outlook.com include:servers.mcsv.net include:_spf.salesforce.com include:mail.zendesk.com include:spf.mandrillapp.com include:amazonses.com include:_spf.hubspot.com include:spf.freshdesk.com -all”
“v=spf1 ipv4:192.0.2.10 -all”
“v=DKIM1; p=”
“v=DKIM1; k=rsa”
“v=DMARC1; p=none”
“v=DMARC1; p=reject; rua=mailto:dmarc@example.com; adkim=s; aspf=s”
“v=DMARC1; p=quarantine; pct=25; sp=none; rua=mailto:dmarc@example.com”
How SPF, DKIM and DMARC Work Together
Each record answers a different question about a message. These ten points explain the system.
SPF Checks the Sending Server
SPF lists the servers allowed to send for the envelope domain, the Return-Path. The receiver checks the connecting IP against that list.
“Which domain does SPF check?”
DKIM Checks the Message Signature
DKIM adds a signature header made with a private key, and publishes the public key at selector._domainkey. It survives forwarding, unlike SPF.
“Where is a DKIM public key published?”
DMARC Ties Them to the From Address
DMARC passes when SPF or DKIM passes and its domain aligns with the visible From domain. It also says what to do when neither does.
“How many of SPF and DKIM must align for DMARC to pass?”
Qualifiers Set the Result
In SPF, - means fail, ~ softfail, ? neutral and + pass, with + as the default when no qualifier is written.
“What does ~all mean?”
Ten DNS Lookups at Most
Evaluating an SPF record may trigger at most 10 DNS lookups, counting nested includes. Exceeding it makes SPF fail with a permanent error.
“What happens at 11 lookups?”
One SPF Record per Domain
Publishing two v=spf1 TXT records at the same name is a permanent error. Merge them into one record.
“Can a domain have two SPF records?”
DKIM Selectors Allow Rotation
Each sending service gets its own selector, such as google or s1, so keys can be added and retired without downtime.
“Why use several DKIM selectors?”
DMARC Policies Escalate
p=none monitors, p=quarantine sends failures to spam, and p=reject refuses them. Most domains move up as reports confirm all real mail passes.
“Which DMARC policy refuses failing mail?”
Alignment Can Be Relaxed or Strict
Relaxed alignment accepts subdomains of the From domain, strict requires an exact match. Relaxed is the default and suits most senders.
“Does relaxed SPF alignment accept mail.example.com for example.com?”
Reports Show Who Sends as You
Aggregate reports, sent to the rua address, list every source that sent mail claiming your domain and whether it passed.
“Which tag receives aggregate reports?”
What Mailbox Providers Require
Since 2024 the largest mailbox providers have made authentication mandatory for bulk senders.
Gmail Bulk Sender Rules
Senders of more than 5,000 messages a day to Gmail must have SPF, DKIM and a DMARC record, with one of SPF or DKIM aligned to the From domain.
Yahoo and AOL
Yahoo applies the same rules as Gmail for bulk senders, including a DMARC record of at least p=none and easy unsubscribing.
Microsoft Outlook.com
Outlook.com, Hotmail and Live began requiring SPF, DKIM and DMARC for senders of more than 5,000 messages a day in 2025.
Every Sender Benefits
Even small senders land in spam more often without SPF and DKIM. All three records together are the baseline.
Domains That Never Send
Parked domains should publish v=spf1 -all and a DMARC record with p=reject, so nobody can spoof them.
BIMI Needs Enforcement
Showing your logo in inboxes with BIMI requires DMARC at quarantine or reject, not none.
Email Authentication Mistakes
These are the setups that most often break delivery or leave a domain open to spoofing.
Too Many Includes
Every marketing and support tool asks to be included in SPF, and the lookups add up fast. Past 10, SPF fails for everything.
Two SPF Records
Adding a second v=spf1 record for a new service breaks both. Add the service’s include to the existing record instead.
Ending With +all
+all authorises the whole internet to send as you, defeating SPF entirely. Use ~all while testing and -all when sure.
Forgetting DKIM for Third-Party Senders
Each service that sends as your domain needs its own DKIM selector set up, or its mail fails DMARC alignment.
Staying on p=none Forever
p=none is for observing, not protecting. Review reports for a few weeks, then move to quarantine and reject.
Weak DKIM Keys
1024-bit RSA keys are the legal minimum and increasingly distrusted. Generate 2048-bit keys when rotating.
Line Breaks in DKIM Keys
Long keys pasted with line breaks or stray quotes inside become invalid. Split them only into separate quoted strings.
Forgetting Subdomains
A strict policy on the main domain can be bypassed through subdomains if sp=none. Leave sp unset to inherit p.
When to Check Your Records
Whenever mail starts landing in spam, and whenever a new sending service is added.
Fixing Mail That Lands in Spam
Check all three records for a missing, invalid or weak setting before blaming content.
Adding a New Email Service
Before adding another include, count the SPF lookups so the new service doesn’t break the old ones.
Meeting Gmail and Yahoo Requirements
Confirm SPF, DKIM and DMARC are published and valid before bulk sending.
Rolling Out DMARC Enforcement
Check each step from p=none to quarantine and reject, and that pct reaches 100.
Rotating DKIM Keys
Confirm the new key is 2048 bits and the old selector is revoked with an empty p= when retired.
Protecting Parked Domains
Check that domains which never send mail reject everything, so they can’t be used for phishing.
Reviewing a DNS Change
Paste a record before publishing it, since a typo can stop all mail from authenticating.