What are SPF and DMARC?
SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting & Conformance) are DNS-based email authentication standards that prevent spoofing. SPF is a TXT record that lists which servers are authorized to send email for a domain. DMARC builds on SPF and DKIM — it tells receiving servers what to do with mail that fails authentication: report it (p=none), quarantine it (p=quarantine), or reject it (p=reject). Together they protect against phishing emails that fake a domain in the From: header.
How to use this tool
- 1 Type a domain and click Check — both SPF and DMARC are looked up in parallel.
- 2 SPF is found in the domain's TXT records; DMARC is found at _dmarc.yourdomain.com.
- 3 Each record is shown raw and then parsed into individual tags with plain-English descriptions.
- 4 A green FOUND badge means the record exists; red NOT FOUND means it is missing.
Frequently asked questions
What does p=none vs p=quarantine vs p=reject mean?
p=none monitors without taking action — unauthenticated mail is still delivered. p=quarantine sends failing mail to the spam folder. p=reject drops failing mail entirely. Start with none, monitor aggregate reports (rua), then tighten to quarantine and finally reject.
What is the -all vs ~all difference in SPF?
-all (hard fail) tells receivers to reject mail from any server not listed in the record. ~all (soft fail) marks it as suspicious but allows delivery. ~all is safer for gradual rollout; -all gives the strongest protection.
What is the rua tag in DMARC?
rua specifies where to send aggregate XML reports showing who is sending mail using your domain. These reports help you identify legitimate sources you forgot to authorize in SPF before tightening policy.
Why might DMARC be missing?
Many domains only publish SPF and skip DMARC. Without DMARC, SPF alone provides no policy enforcement — receivers may still deliver forged mail even if SPF fails. Publishing even p=none provides reporting visibility.
Does this tool send queries to ServoDev?
No. DNS queries go directly to Cloudflare DoH (cloudflare-dns.com/dns-query). No data passes through ServoDev servers.