Skip to content

Menu

Book a free consultation

Free SPF and DMARC checker.

See in seconds, in plain English, whether scammers can send email as your business, and what to fix.

Free · No sign-up · Nothing stored

Check your SPF and DMARC records

The checker runs in your browser and needs JavaScript. Everything else on this page works without it.

Just need new records? Use the generator

How it works

How this checker works

  • Your browser asks public DNS for three things: your mail servers (MX), your SPF record and your DMARC record. It also follows every include in your SPF record to count the lookups.
  • Each record is read against the current standards (RFC 7208 for SPF, RFC 9989 for DMARC). Every finding comes in plain English, with the technical detail one click away.
  • If a lookup fails, we say so instead of guessing. DKIM can't be checked without its selector name, so we ask for it rather than calling it missing.

How an SPF record works, and the 10-lookup limit

An SPF record is one TXT record at your domain that starts with v=spf1 and lists every service allowed to send email as you, for example v=spf1 include:_spf.google.com include:mailgun.org ~all. The ending says what happens to everyone else: ~all marks them as suspicious and -all fails them.

  • You can have only one SPF record. Two make SPF fail for every email.
  • Each include, a, mx, exists and redirect costs a DNS lookup, and so do the includes inside them. Over 10 lookups and SPF fails (RFC 7208). The checker above counts them for you.
  • Keep all at the very end: anything after it is ignored. Never use +all, which lets anyone send as you.

How to check a DMARC or SPF record yourself

On macOS or Linux, run dig +short TXT _dmarc.yourbusiness.com for DMARC and dig +short TXT yourbusiness.com for SPF. On Windows, use nslookup -type=TXT _dmarc.yourbusiness.com. You'll see the raw record; the checker above also explains it and counts the SPF lookups.

Most small businesses aren't protected

had no DMARC record at all
46.6%
had nothing telling inboxes to block fakes
82%
had no SPF record
10.9%
asked for DMARC reports
28%

ZNova study of 1,728 local business domains, October 2026.

Email security questions, answered.

Our security hardening service
What are SPF, DKIM and DMARC?

Three DNS records that prove an email really came from you. SPF lists the services allowed to send as your domain. DKIM adds a digital signature to each email. DMARC tells inboxes what to do when an email fails those checks (nothing, spam folder or reject) and sends you reports about who is using your domain.

Why do my emails say they don't pass DMARC?

The service that sent them isn't listed in your SPF record, or isn't signing with DKIM on your domain, so the email can't prove it came from you. Run the check above, add the missing service to SPF, switch on DKIM in that service, then test again.

Why can't you check my DKIM?

A DKIM key lives at a name only you and your email provider know (the selector, for example google._domainkey.yourbusiness.com). Without that name, nobody can look it up from outside, so a missing result doesn't mean DKIM is off. Enter your selector under Signing (DKIM) after a check, or find it in an email's headers after s=.

I only use a Gmail or Outlook.com address. Do I need this?

No. You can't add records to gmail.com or outlook.com, and Google and Microsoft look after them. But if you send quotes or invoices, an address on your own domain is easier for customers to trust and possible to protect. In our study, 12% of businesses with their own domain still gave a free email address as their contact.

Is this tool free? What do you store?

It's free, with no sign-up. The lookups run in your browser through Cloudflare's public DNS (Google's as a backup), so ZNova never receives the domain you check and stores nothing.

Can you set it up for me?

Yes. We'll check every service that sends email as you, set up SPF, DKIM and DMARC, read the reports with you and move you to full protection safely. It's part of our security hardening work.

Rather we set it up for you?

We'll find every service that sends email as you, publish the right records and take you from monitoring to full protection without blocking your own email.

Get help with email securityEmail us

Free consultation. No obligation and no sales script.

Popular searches

Change theme