ReaperCloud

DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

DMARC

Tells receivers what to do when authentication fails
Enforcement Partial enforcement
Domain policy quarantine
Subdomain policy reject
Aggregate reporting 1 aggregate address

Published record

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1

Warnings

Valid, but weaker than it could be.

Tag breakdown

TagValueMeaning
v DMARC1 Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored.
p quarantine Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block).
sp reject Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted.
pct 100 Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on.
rua mailto:dmarc@github.com Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows.
ruf mailto:dmarc@github.com Forensic report address Where per-message failure (RUF) reports are sent. Many providers never send these, and reports may contain message content.
fo 1 Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails).
adkim default r DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
aspf default r SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
ri default 86400 Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless.

Rows marked default are not in the record; these are the values receivers assume.

SPF

Lists the servers allowed to send mail for the domain
DNS lookups 10 / 10
Unlisted senders ~all (softfail)
Includes 9
Nested records 9

Published record

v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all

Worth knowing

Mechanism breakdown

TermCostMeaning
ip4:192.30.252.0/22 free Authorises an IPv4 address or range. Costs no lookup.
include:spf.protection.outlook.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_netblocks.google.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_netblocks2.google.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:mail.zendesk.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_spf.salesforce.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:servers.mcsv.net 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:mktomail.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:sendgrid.net 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
ip4:62.253.227.114 free Authorises an IPv4 address or range. Costs no lookup.
ip4:166.78.69.169 free Authorises an IPv4 address or range. Costs no lookup.
ip4:166.78.69.170 free Authorises an IPv4 address or range. Costs no lookup.
ip4:166.78.71.131 free Authorises an IPv4 address or range. Costs no lookup.
~all free Matches everything else. Its qualifier decides what happens to mail from any server not listed above.

Include resolution

Every record reached while evaluating this domain. Each nested record spends lookups from the same budget of 10.