Enter a domain to check its SPF, DMARC, DKIM and MX configuration. Free, no sign-up required.
The DMARC / Anti-Spoofing Check analyses a domain's email authentication configuration for free. Enter any domain and instantly see the status of SPF, DMARC, DKIM and MX — with a plain-English report. No sign-up, no data stored.
It detects the SPF 10-lookup overflow that silently invalidates authentication, and implements RFC 7489 §6.6.3 subdomain inheritance so that subdomains that rely on the organisation domain's DMARC policy are correctly evaluated.
| Grade | Meaning |
|---|---|
| protected | DMARC policy is p=reject or p=quarantine and SPF is clean. Spoofed mail is blocked or quarantined. |
| monitoring | A DMARC record exists but p=none — spoofed mail is not yet rejected. Collect reports and work towards p=reject. |
| partial | DMARC policy is present but there is an SPF problem that prevents full protection. |
| unprotected | No DMARC record, or a critical authentication problem. Spoofed mail is not stopped. |
The SPF 10-lookup limit: An SPF evaluation may perform at most 10 DNS lookups (RFC 7208 §4.6.4). Each include: directive typically triggers several internal lookups, so adding a few sending services is often enough to exceed the limit. When exceeded, SPF enters permerror and authentication fails for all senders — even legitimate ones.
My result is "monitoring (p=none)". Can I switch straight to p=reject?
Jumping directly to p=reject risks legitimate mail being blocked. First use the DMARC aggregate reports (rua) to identify every system sending as your domain, confirm they all pass authentication, then move to p=quarantine and finally p=reject. See our guide for the step-by-step process.
DKIM shows "not found". Does that mean DKIM is not set up?
DKIM public keys are published under an arbitrary name called a selector. This tool only probes common selectors, so a miss does not confirm that DKIM is unconfigured. Check your mail-sending service's admin panel for the selector name in use.
My SPF lookup count is 8 or 9. Is that a problem?
With a limit of 10, adding just one or two more sending services will push you over the edge. Consider flattening your SPF record or consolidating include: directives sooner rather than later.
A subdomain comes back as "unprotected". What does that mean?
If a subdomain has no _dmarc record of its own, this tool automatically checks the organisation domain's DMARC policy (RFC 7489 §6.6.3). If the org domain has p=reject, the subdomain is rated "protected" via inheritance.