Free email check · no email needed
Free SPF and DMARC checker
Type your domain. We'll read its SPF and DMARC records and tell you, in plain words, whether someone could send mail that looks like it came from you. Takes a couple of seconds.
DNS lookups only. We never touch your site or your mail server. Also try the page check or plugin checker.
How do I check my SPF and DMARC records?
Type your domain into the checker at the top of this page. We look up the TXT record at your domain (SPF) and at _dmarc.yourdomain (DMARC) in public DNS, then tell you whether fake mail sent in your name would be blocked, flagged or delivered. No sign-up, no email needed.
How SPF and DMARC fit together
Two TXT records stop most fake mail.
SPF says who may send for you. DMARC says what happens to mail that fails. You want both, with DMARC set past p=none.
The guest list
One TXT record at your domain, starting v=spf1. List every service that sends for you, end with ~all or -all, and keep it to 10 DNS lookups.
The bouncer
A TXT record at _dmarc.yourdomain. Start with p=none and a rua= address, read the reports, then move to quarantine and reject.
The signature
Your mail provider signs each message. Switch it on in Google Workspace or Microsoft 365. We can't see it from outside, so check the admin panel.
A safe starting record
If you have no DMARC record at all, add this TXT record at _dmarc and swap in your own address:
v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com
It changes nothing for your real mail and starts the daily reports. Once every sender you use shows up as passing, change p=none to p=quarantine.
Questions
What is SPF?
SPF is a TXT record that lists the servers allowed to send mail for your domain, like Google Workspace, Microsoft 365 or your newsletter tool. It ends with ~all or -all to tell receivers what to do with everyone else.
What is DMARC?
DMARC is a TXT record at _dmarc.yourdomain that tells receivers what to do when mail fails SPF or DKIM: nothing (p=none), spam folder (p=quarantine) or refuse it (p=reject). It can also send you daily reports through the rua= tag.
Is p=none good enough?
It is a start. With p=none, fake mail still reaches inboxes and you only get reports. Read them for a couple of weeks, make sure all your real senders pass, then move to quarantine and later reject.
Does this checker look at DKIM?
No. DKIM keys live under a selector name only your mail provider knows, so they can't be listed from outside. Your provider's admin panel shows whether DKIM signing is on.
Is this the same as the full CrawlCare scan?
No. This page only checks SPF and DMARC. The full free scan also covers mobile and desktop speed, SEO basics and your SSL certificate, and emails you the report.
Checking your website next? Try the page check, the WordPress plugin checker or the PHP2Shell scanner. Or run the full free scan.