DMARC & SPF Lookup
Enter a domain to retrieve its DMARC and SPF records, validate every tag and mechanism, and see what’s worth fixing.
DMARC
Tells receivers what to do when authentication fails
Enforcement
Full enforcement
Domain policy
reject
Subdomain policy
reject
Aggregate reporting
2 aggregate addresses
Published record
v=DMARC1; p=reject; aspf=r; adkim=r; sp=reject; fo=1; ruf=mailto:mike@turbosec.io,mailto:dmarc@reapercloud.com; rua=mailto:mike@turbosec.io,mailto:dmarc@reapercloud.com; rf=afrf; pct=100; ri=86400
Looking good
- Policy is at full enforcementp=reject instructs receivers to block mail that fails authentication — the strongest DMARC protection.
- External reporting destination is authorisedreapercloud.com publishes the authorisation record for turbosec.io, so reports sent there will be accepted.
- External reporting destination is authorisedreapercloud.com publishes the authorisation record for turbosec.io, so reports sent there will be accepted.
Tag breakdown
| Tag | Value | Meaning |
|---|---|---|
| v | DMARC1 | Version Protocol version. Must be DMARC1 and must be the first tag, or the whole record is ignored. |
| p | reject | Policy What receivers should do with mail that fails DMARC: none (monitor only), quarantine (treat as suspicious) or reject (block). |
| aspf | r | SPF alignment How strictly the SPF domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match). |
| adkim | r | DKIM alignment How strictly the DKIM domain must match the From domain: r (relaxed, subdomains allowed) or s (strict, exact match). |
| sp | reject | Subdomain policy Policy applied to subdomains. Defaults to the value of p when omitted. |
| fo | 1 | Failure options When to generate failure reports: 0 (all mechanisms fail), 1 (any mechanism fails), d (DKIM fails), s (SPF fails). |
| ruf | mailto:mike@turbosec.io,mailto:dmarc@reapercloud.com | Forensic report address Where per-message failure (RUF) reports are sent. Many providers never send these, and reports may contain message content. |
| rua | mailto:mike@turbosec.io,mailto:dmarc@reapercloud.com | Aggregate report address Where daily aggregate (RUA) XML reports are sent. Without it you get no visibility into your mail flows. |
| rf | afrf | Report format Format for failure reports. In practice only afrf is used. |
| pct | 100 | Percentage Portion of failing mail the policy applies to (0–100). Anything below 100 means most failing mail is not acted on. |
| ri | 86400 | Report interval Requested seconds between aggregate reports. Defaults to 86400 (daily); most receivers send daily regardless. |
Rows marked default are not in the record; these are the values receivers assume.
SPF
Lists the servers allowed to send mail for the domain
DNS lookups
1 / 10
Unlisted senders
~all (softfail)
Includes
1
Nested records
1
Published record
v=spf1 include:spf.protection.outlook.com ~all
Worth knowing
- Unlisted senders are soft-failed~all marks unlisted senders as suspicious rather than forbidden. That is the right setting while you are still discovering senders; tighten to -all once your DMARC reports are clean.
Mechanism breakdown
| Term | Cost | Meaning |
|---|---|---|
| include:spf.protection.outlook.com | 1 lookup | Authorises another domain’s SPF record as well. Costs one DNS lookup, plus every lookup inside it. |
| ~all | free | Matches everything else. Its qualifier decides what happens to mail from any server not listed above. |
Include resolution
Every record reached while evaluating this domain. Each nested record spends lookups from the same budget of 10.
-
spf.protection.outlook.com no further lookups
v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all