Skip to content

SPF & DMARC Checker

Enter a domain and Nivaronix looks up its SPF and DMARC records over DNS, then reports exactly what it found — missing records, conflicting policies, or weak enforcement — with the raw DNS evidence attached to every finding.

What this checker looks at

  • SPF missing — no record beginning with v=spf1 published for the domain.
  • Multiple SPF records — RFC 7208 allows exactly one; a second record makes receivers treat SPF as permanently broken.
  • SPF hard fail (-all), soft fail (~all), and no enforcement (+all / ?all) — which qualifier the record ends in, and what that means for unauthorized senders.
  • SPF with no final policy or delegated via redirect=, and approaching the 10-DNS-lookup limit SPF enforces on itself.
  • DMARC missing — no record at _dmarc.<domain>.
  • DMARC policy is monitor-only (p=none) — reports are collected but nothing is enforced.
  • DMARC with no usable policy tag — a record exists but its p= tag is missing or invalid, so receivers ignore it.

How it works

The scan performs a live TXT lookup for your domain and for _dmarc.<domain>, parses the returned records, and classifies the result against the checks above. If a lookup times out or a nameserver fails to answer, that is reported as inconclusive rather than as a missing record — we only report "missing" when DNS authoritatively says so.

About DKIM

DKIM is a separate, complementary email-authentication mechanism that adds a cryptographic signature to outgoing mail. Nivaronix currently does not perform DKIM verification — this scan checks SPF and DMARC only. If you need DKIM validated, use your mail provider's DKIM test tool or a dedicated mail-auth checker.

Learn more

Run the check on your domain

Free, no signup for a single scan. SPF and DMARC are part of every full Nivaronix scan alongside CAA, DNSSEC, headers, and TLS.

Scan your domain free

Want the full picture? See everything Nivaronix's website security scanner checks.