Skip to content
TextArray1.41.0
100% local

SPF and DMARC checker

Check a pasted SPF, DMARC or DKIM DNS record and explain what each part means.

Input
Output
Related tools
Email list validatorLists & combinations
HTTP header parserDeveloper tools
CSP header generatorDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
SPF and DMARC checker
Paste an SPF, DMARC or DKIM record — copied from a "dig TXT" result or your registrar's control panel — and this tool explains every mechanism or tag in plain English, then lists anything misconfigured. It is built for setting up outbound email, troubleshooting messages landing in spam, or reviewing a domain you have inherited.
Switch "Record type" between SPF, DMARC and DKIM to match what you pasted; the record's own version tag is checked against the selection, so picking the wrong one is caught rather than misread. For SPF, the tool counts every mechanism that costs a DNS lookup — include, a, mx, ptr, exists and the redirect modifier — and warns as you approach the ten-lookup ceiling RFC 7208 imposes, flags "+all" as an open relay and "~all" as softer than "-all". For DMARC, it checks the policy (none, quarantine or reject), the pct rollout percentage, whether aggregate (rua) and forensic (ruf) addresses are set, and whether adkim/aspf alignment is relaxed or strict. DKIM checking covers the key type, an empty p= as an intentionally revoked key, and the t=y testing flag.
Findings are ranked by severity: an error means the record will not work, a warning means it works but leaves a gap, and an info note explains a choice valid either way. Paste straight from a terminal — the tool strips a dig-style "name TTL IN TXT" prefix and rejoins quoted TXT strings, and treats Windows and Unix line endings the same way.
Everything runs in your browser. The record is never uploaded or logged, and nothing here performs an actual DNS lookup, so keep a copy of the text before pasting it in. Copy the report, download it as a .txt file, or send the output back into the input after fixing a value.
FAQ
Does this tool perform a real DNS lookup?
No. You paste the record text yourself and the tool checks its syntax and settings — it never queries DNS, so it works offline and cannot leak which domain you are checking.
Why does it say my record type does not match?
The record's own version tag (v=spf1, v=DMARC1) is checked against the "Record type" option. If they disagree, the tool reports the mismatch instead of guessing, since parsing an SPF record as if it were DMARC would produce nonsense.
What counts toward the SPF 10-lookup limit?
The include, a, mx, ptr and exists mechanisms each cost one DNS lookup, and so does the redirect modifier. ip4, ip6 and all are free. Going over ten causes receivers to treat the whole record as a permanent error.
What does an empty DKIM p= value mean?
An empty p= is a deliberately revoked key — the selector is being turned off, not misconfigured. The tool reports it as informational rather than an error.
Is my DNS record uploaded anywhere?
No. Checking runs entirely in your browser — the text you paste never leaves your device.