DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

DMARC

Tells receivers what to do when authentication fails

Enforcement Full enforcement

Domain policy reject

Subdomain policy none

Aggregate reporting 1 aggregate address

v=DMARC1;p=reject;sp=none;np=reject;adkim=s;aspf=s;fo=1;rua=mailto:dmarc-rua@dmarc.service.gov.uk

Valid, but weaker than it could be.

Subdomains are less protected than the domainsp=none is weaker than p=reject. Attackers routinely spoof subdomains precisely because they are left unprotected.

Policy is at full enforcementp=reject instructs receivers to block mail that fails authentication — the strongest DMARC protection.
External reporting destination is authoriseddmarc.service.gov.uk publishes the authorisation record for gov.uk, so reports sent there will be accepted.

Tag	Value	Meaning
v	DMARC1	Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored.
p	reject	Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block).
sp	none	Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted.
np	reject	Non-existent subdomain policy Policy for subdomains that have no DNS records at all. A newer tag, not yet honoured by every receiver.
adkim	s	DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
aspf	s	SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
fo	1	Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails).
rua	mailto:dmarc-rua@dmarc.service.gov.uk	Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows.
pct default	100	Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on.
ri default	86400	Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless.

Rows marked default are not in the record; these are the values receivers assume.

Lists the servers allowed to send mail for the domain

DNS lookups 0 / 10

Unlisted senders -all (fail)

Includes 0

Nested records 0

v=spf1 -all

Unlisted senders are rejected-all tells receivers that any server not listed is forbidden to send for this domain — the correct end state.

Term	Cost	Meaning
-all	free	Matches everything else. Its qualifier decides what happens to mail from any server not listed above.