ReaperCloud

DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

DMARC

Tells receivers what to do when authentication fails
Enforcement Full enforcement
Domain policy reject
Subdomain policy reject (inherited)
Aggregate reporting 2 aggregate addresses

Published record

v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email

Worth knowing

Looking good

Tag breakdown

TagValueMeaning
v DMARC1 Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored.
p reject Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block).
rua mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows.
ruf mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email Forensic report address Where per-message failure (RUF) reports are sent. Many providers never send these, and reports may contain message content.
sp default inherits p Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted.
adkim default r DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
aspf default r SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
pct default 100 Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on.
fo default 0 Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails).
ri default 86400 Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless.

Rows marked default are not in the record; these are the values receivers assume.

SPF

Lists the servers allowed to send mail for the domain
DNS lookups 9 / 10
Unlisted senders ~all (softfail)
Includes 9
Nested records 9

Published record

v=spf1 include:pp._spf.paypal.com include:3ph1._spf.paypal.com include:3ph2._spf.paypal.com include:3ph3._spf.paypal.com include:3ph4._spf.paypal.com include:sendgrid.net include:aspmx.pardot.com ~all

Worth knowing

Mechanism breakdown

TermCostMeaning
include:pp._spf.paypal.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:3ph1._spf.paypal.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:3ph2._spf.paypal.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:3ph3._spf.paypal.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:3ph4._spf.paypal.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:sendgrid.net 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:aspmx.pardot.com 1 lookup Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
~all free Matches everything else. Its qualifier decides what happens to mail from any server not listed above.

Include resolution

Every record reached while evaluating this domain. Each nested record spends lookups from the same budget of 10.