DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

DMARC

Tells receivers what to do when authentication fails

Enforcement Full enforcement

Domain policy reject

Subdomain policy reject (inherited)

Aggregate reporting 1 aggregate address

v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com

Policy is at full enforcementp=reject instructs receivers to block mail that fails authentication — the strongest DMARC protection.

Tag	Value	Meaning
v	DMARC1	Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored.
p	reject	Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block).
rua	mailto:mailauth-reports@google.com	Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows.
sp default	inherits p	Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted.
adkim default	r	DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
aspf default	r	SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
pct default	100	Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on.
fo default	0	Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails).
ri default	86400	Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless.

Rows marked default are not in the record; these are the values receivers assume.

Lists the servers allowed to send mail for the domain

DNS lookups 1 / 10

Unlisted senders ~all (softfail)

Includes 1

Nested records 1

v=spf1 include:_spf.google.com ~all

Unlisted senders are soft-failed~all marks unlisted senders as suspicious rather than forbidden. That is the right setting while you are still discovering senders; tighten to -all once your DMARC reports are clean.

Term	Cost	Meaning
include:_spf.google.com	1 lookup	Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
~all	free	Matches everything else. Its qualifier decides what happens to mail from any server not listed above.

Every record reached while evaluating this domain. Each nested record spends lookups from the same budget of 10.

_spf.google.com no further lookups
v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all