Skip to content

Tools

DMARC & SPF Checker

Check in seconds whether a domain is protected against email spoofing: DMARC policy, SPF record and MX — with a plain-language verdict.

The DNS query goes directly from your browser to Cloudflare DNS (1.1.1.1, fallback Google DNS) — yurtbay.dev never sees the queried domain and stores nothing.

How the DMARC & SPF check works

How does the check work?

The tool performs three DNS queries: the TXT record at _dmarc.your-domain.com (DMARC policy), the SPF record in the domain's TXT record, and the MX records. It then evaluates the results against the rules of the standards (RFC 7489 for DMARC, RFC 7208 for SPF): Which policy applies — p=none, quarantine or reject? Does the SPF record end with a meaningful all mechanism? Are reports (rua) being received, and does SPF stay under the limit of ten DNS lookups? You get the result as a plain-language verdict instead of cryptic record syntax.

Why no upload?

The query runs as DNS-over-HTTPS directly from your browser to Cloudflare DNS (1.1.1.1, fallback: Google DNS). yurtbay.dev never sees the checked domain or the result — there is no server that could log anything. Only public DNS data is checked: exactly what every receiving mail server queries during delivery anyway.

When is professional help worth it?

A missing record is quickly added — the demanding part is getting to an enforcing policy. If your domain sits on p=none permanently, several systems send in your name (Microsoft 365, newsletter tool, ticket system, online shop) or DKIM is still missing, a structured approach pays off: inventory all senders, evaluate rua reports and tighten the policy step by step to quarantine and reject — without losing legitimate mail. I support this as part of IT support & managed services. For background, read Ransomware protection for small businesses and Self-hosting your email server vs. Microsoft 365.

Frequently asked questions about DMARC & SPF

What does p=none in my DMARC record mean?

p=none is pure monitoring mode: receivers evaluate your mail but do not reject forgeries. As a starting point for collecting reports that is correct — as a permanent state it does not protect you. The goal is p=quarantine or p=reject.

Isn't SPF on its own enough?

No. SPF only checks whether the delivering server may send for the domain — the sender address visible in the mail client can still be forged. Only DMARC ties SPF (and DKIM) to the visible from address and tells receivers what to do with forgeries.

Why does DMARC matter right now?

Large receivers such as Google and Yahoo have required a DMARC record from bulk senders since 2024; without one, mail ends up in spam far more often or is rejected. And for attackers, domains without DMARC are the easiest target for phishing in your company's name.

Does the tool also check DKIM?

No. DKIM records live under a freely chosen selector (e.g. selector1._domainkey.your-domain.com) that cannot be reliably guessed from the outside. Whether DKIM signs correctly is visible in your DMARC reports (rua) or in the header of a received mail.