Skip to content

SPF & DMARC Checker

Enter a domain and Nivaronix looks up its SPF and DMARC records over DNS, then reports exactly what it found — missing records, conflicting policies, or weak enforcement — with the raw DNS evidence attached to every finding.

What this checker looks at

  • SPF missing — no record beginning with v=spf1 published for the domain.
  • Multiple SPF records — RFC 7208 allows exactly one; a second record makes receivers treat SPF as permanently broken.
  • SPF hard fail (-all), soft fail (~all), and no enforcement (+all / ?all) — which qualifier the record ends in, and what that means for unauthorized senders.
  • SPF with no final policy or delegated via redirect=, and approaching the 10-DNS-lookup limit SPF enforces on itself.
  • DMARC missing — no record at _dmarc.<domain>.
  • DMARC policy is monitor-only (p=none) — reports are collected but nothing is enforced.
  • DMARC with no usable policy tag — a record exists but its p= tag is missing or invalid, so receivers ignore it.

How it works

The scan performs a live TXT lookup for your domain and for _dmarc.<domain>, parses the returned records, and classifies the result against the checks above. If a lookup times out or a nameserver fails to answer, that is reported as inconclusive rather than as a missing record — we only report "missing" when DNS authoritatively says so.

About DKIM

DKIM is a separate, complementary email-authentication mechanism that adds a cryptographic signature to outgoing mail. Nivaronix does check DKIM, as part of its DNS checks rather than the SPF/DMARC ones: it queries a short, fixed list of common selectors at <selector>._domainkey.<your-domain> and reports whether a usable DKIM public key is published at one of them. Because DKIM has no directory lookup — the selector name is chosen by whichever platform signs your mail, and there is no way to enumerate it from outside — a "no DKIM record found" result is evidence, not proof: a domain signing with a selector outside that list looks identical to a domain with no DKIM at all. Nivaronix also does not validate DKIM signatures on live mail, so this is a published-key check rather than a full DKIM audit. The DKIM guide lists the exact selectors tried.

Learn more

Run the check on your domain

Free, no signup for a single scan. SPF and DMARC are part of every full Nivaronix scan alongside CAA, DNSSEC, headers, and TLS.

Scan your domain free

Want the full picture? See everything Nivaronix's website security scanner checks.

A DMARC policy can silently regress back to p=noneafter a vendor migration, and nobody notices until phishing using your domain turns up in someone's inbox. Nivaronix's platform monitors SPF and DMARC continuously instead of only at scan time.