DMARC & SPF Lookup

Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.

DMARC

Tells receivers what to do when authentication fails

Enforcement Full enforcement

Domain policy reject

Subdomain policy reject (inherited)

Aggregate reporting 2 aggregate addresses

v=DMARC1;p=reject;fo=1:d:s;pct=100;rua=mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com;ruf=mailto:0e5a5c34@inbox.ondmarc.com

Policy is at full enforcementp=reject instructs receivers to block mail that fails authentication — the strongest DMARC protection.
External reporting destination is authorisedvali.email publishes the authorisation record for salesforce.com, so reports sent there will be accepted.
External reporting destination is authorisedinbox.ondmarc.com publishes the authorisation record for salesforce.com, so reports sent there will be accepted.
External reporting destination is authorisedinbox.ondmarc.com publishes the authorisation record for salesforce.com, so reports sent there will be accepted.

Tag	Value	Meaning
v	DMARC1	Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored.
p	reject	Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block).
fo	1:d:s	Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails).
pct	100	Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on.
rua	mailto:dmarc_agg@vali.email,mailto:0e5a5c34@inbox.ondmarc.com	Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows.
ruf	mailto:0e5a5c34@inbox.ondmarc.com	Forensic report address Where per-message failure (RUF) reports are sent. Many providers never send these, and reports may contain message content.
sp default	inherits p	Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted.
adkim default	r	DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
aspf default	r	SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match).
ri default	86400	Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless.

Rows marked default are not in the record; these are the values receivers assume.

Lists the servers allowed to send mail for the domain

DNS lookups 4 / 10

Unlisted senders ~all (softfail)

Includes 2

Nested records 2

v=spf1 include:_spf.google.com include:_spf.salesforce.com exists:%{i}._spf.corp.salesforce.com ~all

Unlisted senders are soft-failed~all marks unlisted senders as suspicious rather than forbidden. That is the right setting while you are still discovering senders; tighten to -all once your DMARC reports are clean.

Term	Cost	Meaning
include:_spf.google.com	1 lookup	Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
include:_spf.salesforce.com	1 lookup	Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it.
exists:%{i}._spf.corp.salesforce.com	1 lookup	Authorises if a lookup of the given name succeeds. Costs one lookup.
~all	free	Matches everything else. Its qualifier decides what happens to mail from any server not listed above.

Every record reached while evaluating this domain. Each nested record spends lookups from the same budget of 10.

_spf.google.com no further lookups
v=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ~all
_spf.salesforce.com 1 further lookup
v=spf1 exists:%{i}._spf.mta.salesforce.com -all