How to check SPF and DMARC records and fix the common errors

SPF tells receivers which servers may send mail for your domain. DMARC tells them what to do when a message fails. Both are a TXT record away, and both have rules that are easy to break.

Updated 2026-10-17 · Venture Lab 10

SPF: the rules that matter (RFC 7208)

• Exactly one SPF record. A domain publishes SPF as a TXT record starting with v=spf1. RFC 7208 section 4.5 says that if more than one record is found, the result is permerror. SPF then fails for every message. Merge them into one record.
• At most 10 DNS-querying terms. Section 4.6.4 limits the total of include, a, mx, ptr, exists and redirect to 10 during evaluation, including nested includes. Going over is also a permerror. The terms ip4, ip6 and all do not count.
• End with an all mechanism. -all (fail) or ~all (softfail) treats unlisted servers as unauthorised. ?all is neutral. +all lets any server on the internet pass SPF for your domain, so never publish it.

example.com.  TXT  "v=spf1 include:_spf.mail-provider.example ip4:192.0.2.10 -all"

DMARC: the rules that matter (RFC 9989)

DMARC was updated in May 2026: RFC 9989 (core), RFC 9990 (aggregate reports) and RFC 9991 (failure reports) obsolete RFC 7489.

• The record lives at _dmarc. + your domain as a TXT record starting with v=DMARC1.
• Exactly one record. If several DMARC records are returned for a name, RFC 9989 says they are all discarded. That means no policy at all.
• Set a policy. p=none only monitors, p=quarantine asks receivers to treat failures as suspicious, and p=reject asks them to reject failures. Under RFC 9989 a record without p= is treated as p=none, so spoofed mail is still delivered.
• Ask for reports. rua=mailto:… asks receivers to send aggregate reports about who sends mail as your domain. Read them before you move from none to quarantine or reject.
• Know which tags changed. RFC 9989 deprecates pct, rf and ri, and adds np (policy for non-existent subdomains).

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

Domains that never send mail

For a parked or web-only domain, publish an SPF record of v=spf1 -all and a DMARC record with p=reject. A null MX record (RFC 7505: MX 0 .) also says the domain accepts no mail.

Check it in one step

The free Domain Watch check reads your records from your browser through public DNS-over-HTTPS, and flags:

• multiple SPF records, +all, ?all and a missing all;
• SPF records close to or over the lookup limit: a warning at 8 or more DNS-querying terms, critical above 10. It counts top-level terms only, so nested includes add more;
• a missing DMARC record, multiple DMARC records, no p= and p=none;
• a missing rua.

It also shows A/AAAA, MX (including null MX), NS, CAA, whether the resolver validated DNSSEC, and the registration expiry date from RDAP.

It does not show TLS certificate expiry, because browsers do not let a page read certificates.

Venture Lab 10 is independent. Other product and service names are used only to describe compatibility or for comparison, and are trademarks of their owners.

← All guides