SPF & DMARC Checker

Test a domain's email authentication: SPF, DKIM and DMARC records are checked for syntax, lookup limits and policy strength, with plain-English fixes.

Email authentication for outlook.com

SPFValid
DKIM2 keys found
DMARCp=none

SPF (Sender Policy Framework)

1/10 DNS lookups
v=spf1 include:spf2.outlook.com -all
  • SPF record is valid and ends with -all.

DKIM (DomainKeys Identified Mail)

Selector selector1 (via CNAME selector1._domainkey.outbound.protection.outlook.com)

v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWyktrIL8DO/+UGvMbv7cPd/Xogpbs7pgVw8y9ldO6AAMmg8+ijENl/c7Fb1MfKM7uG3LMwAr0dVVKyM+mbkoX2k5L7lsROQr0Z9gGSpu7xrnZOa58+/pIhd2Xk/DFPpa5+TKbWodbsSZPRN8z0RY5x59jdzSclXlEyN9mEZdmOiKTsOP6A7vQxfSya9jg5N81dfNNvP7HnWejMMsKyIMrXptxOhIBuEYH67JDe98QgX14oHvGM2Uz53if/SW8MF09rYh9sp4ZsaWLIg6T343JzlbtrsGRGCDJ9JPpxRWZimtz+Up/BlKzT6sCCrBihb/Bi3pZiEBB4Ui/vruL5…

Selector selector2 (via CNAME selector2._domainkey.outbound.protection.outlook.com)

v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv4FtIHuwq9952OTOwVZEofzUo9nZJZV7Hn3zOXBHaEOP71nMs+uCheSeYRH34PLvo9MngvAFxXG4X8dpL35onCZq2uivZrSBid1ZPDiDqTsK8y26vCV/RpVSWeJEO0SWejooFY7RJ1sbSIxj3Yj4n95oysVoNk3OIJcLryIgjPwzoxFyFQKfpfzAuBf0xvAs29JW9whxe1A7J9Z+wJVhVs37o2ua+sMb7ypEhVjoGHJnGpHh3qq8ukHMw6XAiSD1bG5jndbWNXEf93E1UAAmIYZvxGqwFU0cpCu9YwmwEXYQtAXORinEYAIQKpIlCtH0hW6XKnsbxnbmUmRs/a1…

DMARC

v=DMARC1; p=none; sp=quarantine; pct=100; rua=mailto:rua@dmarc.microsoft; ruf=mailto:ruf@dmarc.microsoft; fo=1
Policy (p)
none
Subdomain policy (sp)
quarantine
Aggregate reports (rua)
mailto:rua@dmarc.microsoft
Percentage (pct)
100%
Alignment
DKIM: R, SPF: R (R = relaxed, S = strict)
  • Policy is p=none (monitor only). Once reports look clean, move to p=quarantine and then p=reject.

See the MX records for outlook.com (mail handled by Microsoft 365).

Why SPF, DKIM and DMARC matter

Email was designed without sender verification, so anyone can put your domain in the "From" line. Three DNS-based standards fix that. Since February 2024, Google and Yahoo have required them from bulk senders, and missing records are now a common reason legitimate mail lands in spam.

  • SPF lists the servers allowed to send mail for your domain, in a TXT record starting with v=spf1.
  • DKIM adds a cryptographic signature to each message; receivers verify it with a public key published at selector._domainkey.yourdomain.
  • DMARC (at _dmarc.yourdomain) tells receivers what to do when SPF and DKIM fail to align with the From domain (none, quarantine or reject) and where to send reports.

What this checker tests

  • SPF exists, there is only one record, it ends in ~all or -all (never +all), and the total number of DNS lookups including nested include: mechanisms stays within the RFC 7208 limit of 10.
  • DKIM keys on the selector you supply, or on a dozen common selectors used by Google Workspace, Microsoft 365 and popular sending services.
  • DMARC exists, has a valid policy, applies to 100% of mail and sends aggregate reports so you can see who is sending as you.

Example records

example.com.         TXT  "v=spf1 include:_spf.example.net ip4:192.0.2.0/24 -all"
_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s"
s1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

Recommended rollout

  1. Publish SPF covering every service that sends for you, ending with ~all.
  2. Turn on DKIM signing in each provider.
  3. Publish DMARC with p=none and an rua address, and review reports for two to four weeks.
  4. Move to p=quarantine, then p=reject, once all legitimate mail passes.

Full walkthrough: SPF, DKIM and DMARC explained.

Frequently asked questions

Should I use ~all or -all?

With DMARC in place, either works; DMARC decides the outcome. ~all is the safer starting point; -all is stricter once you are confident every sender is listed.

What does "too many DNS lookups" mean?

Each include, a, mx, exists and redirect costs a lookup, including those inside included records. Over 10, SPF fails for everyone. Remove unused services or replace includes with ip4/ip6 ranges.

Do parked domains need these records?

Yes. Protect domains that never send email with v=spf1 -all and v=DMARC1; p=reject.

Copied to clipboard