ReaperCloud

DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

DMARC

Tells receivers what to do when authentication fails
Enforcement Full enforcement
Domain policy reject
Subdomain policy reject (inherited)
Aggregate reporting 1 aggregate address

Published record

v=DMARC1; p=reject; pct=100; rua=mailto:itex-rua@microsoft.com; ruf=mailto:itex-ruf@microsoft.com; fo=1

Looking good

Tag breakdown

TagValueMeaning
v DMARC1 Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored.
p reject Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block).
pct 100 Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on.
rua mailto:itex-rua@microsoft.com Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows.
ruf mailto:itex-ruf@microsoft.com Forensic report address Where per-message failure (RUF) reports are sent. Many providers never send these, and reports may contain message content.
fo 1 Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails).
sp default inherits p Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted.
adkim default r DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
aspf default r SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
ri default 86400 Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless.

Rows marked default are not in the record; these are the values receivers assume.

SPF

Lists the servers allowed to send mail for the domain
DNS lookups 7 / 10
Unlisted senders -all (fail)
Includes 7
Nested records 7

Published record

v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-c.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -all

Looking good

Mechanism breakdown

TermCostMeaning
include:_spf-a.microsoft.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_spf-b.microsoft.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_spf-c.microsoft.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_spf-ssg-a.msft.net 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_spf1-meo.microsoft.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
-all free Matches everything else. Its qualifier decides what happens to mail from any server not listed above.

Include resolution

Every record reached while evaluating this domain. Each nested record spends lookups from the same budget of 10.