DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

Try turbosec.io, salesforce.com or gov.uk

What this checks

DMARC policy

We query _dmarc.<domain>, follow the fallback to the organizational domain for subdomains, validate every tag, and flag the case where more than one record is published — which switches DMARC off entirely.

SPF lookup budget

SPF allows only ten DNS lookups. We follow every include: and redirect= recursively and count them, because exceeding the limit is a PermError that makes SPF fail for all of your mail.

Reporting addresses

DMARC report destinations must be valid mailto: URIs. When they point at another domain, that domain has to publish an authorisation record — we check for it, because missing it silently stops reports arriving.

Real protection

A record can be valid and still protect nothing. We call out p=none, reduced pct, weak subdomain policies, and SPF records ending in +all or no all at all.