SPF / DKIM / DMARC Checker

Q: Why can I have only one SPF record?

If a domain publishes more than one v=spf1 TXT record, receivers return a permanent error. Merge them into one record, with one include per provider.

Validate and explain email DNS records

Paste SPF, DKIM, DMARC, MTA-STS or BIMI TXT records to validate them, spot mistakes and see what each part means.

SPF
DKIM
DMARC
DNS
Email

How to use SPF / DKIM / DMARC Checker

In Check records, paste one or more TXT values, or a zone-file or dig snippet such as _dmarc.example.com. IN TXT "v=DMARC1; p=none". Quoted pieces of a split record are joined for you.
Each recognised record (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI) gets a plain-English explanation of every tag or term, plus errors, warnings and notes.
To write a record from scratch, use Build DMARC or Build SPF, set the options, and copy the result or the ready-made zone line.
Publish the record as a TXT record at the name shown (for DMARC, _dmarc.yourdomain.com), then re-check the live value after it propagates.

How it works

The text is split into records and each one is classified by its version tag (v=spf1, v=DKIM1, v=DMARC1, v=STSv1, v=TLSRPTv1, v=BIMI1) or its owner name (._domainkey., _dmarc.). SPF terms are parsed into qualifiers, mechanisms and modifiers; the DNS-lookup limit of 10 (RFC 7208) is counted statically from include, a, mx, ptr, exists and redirect. DKIM p= is base64-decoded and its ASN.1 (DER) structure read to find the RSA modulus size or Ed25519 key; an empty p= is reported as a revoked key. DMARC tags are validated against RFC 7489 and report URIs checked. Nothing is looked up in DNS.

Limits

DNS is never queried. SPF include and redirect records are not followed, so the lookup count is a minimum, and DMARC external report authorisation records can't be verified.
Whether a DKIM key actually matches the signing server, or the MTA-STS policy file and BIMI logo/VMC are valid, can't be checked offline.
Only the first 200,000 characters of input are read.
DMARCbis tags (np, psd, t) are recognised but only lightly validated.
Zone-file parsing handles single-line and parenthesised multi-line TXT records; other record types are ignored.

Privacy

Everything is parsed in your browser. No DNS lookups are made and the text you paste is not uploaded or stored. "Copy share link" puts the pasted text and builder options in the link's fragment, which is not sent to any server; do not share it if the records are sensitive.

Frequently asked questions

Why does SPF fail with more than 10 DNS lookups?

RFC 7208 limits SPF evaluation to 10 lookups (include, a, mx, ptr, exists, redirect) to stop abusive records. Past that, receivers return a permanent error and SPF fails. Replace includes with ip4/ip6 ranges or flatten your providers to stay under it.

Is p=none for DMARC bad?

It is a good first step because it only collects reports, but it does not stop spoofed mail. Review the reports, fix legitimate senders, then move to quarantine and reject.

What does an empty DKIM p= mean?

It revokes the key: the selector remains published, but any message signed with it fails DKIM. Use it when retiring a selector.

Why can I have only one SPF record?

If a domain publishes more than one v=spf1 TXT record, receivers return a permanent error. Merge them into one record, with one include per provider.

More tools

Clean Image: Inspect and remove hidden image metadata
JWT Decoder: Decode and verify JSON Web Tokens
Diff Checker: Compare two texts line by line
JS Runner: Run JavaScript and TypeScript in your browser
JSON Formatter: Format, validate and minify JSON
Encode / Decode: Base64, URL, HTML entity and hex
Hash Generator: MD5, SHA and HMAC of any text
UUID Generator: Generate UUID v4 and v7 in bulk
Timestamp Converter: Unix time ↔ human dates
Regex Tester: Test regular expressions live
URL Parser: Break a URL into its parts
HTTP Status Codes: Look up any HTTP status code
MIME Type Lookup: File extension ↔ MIME type
Password Generator: Strong random passwords and passphrases
Random String Generator: Random tokens, IDs and keys
Slug Generator: Turn titles into URL slugs
Case Converter: camelCase, snake_case, Title Case and more
Word Counter: Count words, characters and reading time
JSON to TypeScript: Generate TypeScript types from JSON
JSON Diff: Compare two JSON documents structurally
JSON to SQL: Turn JSON arrays into SQL inserts
YAML ↔ JSON: Convert between YAML and JSON
XML ↔ JSON: Convert between XML and JSON
CSV ↔ JSON: Convert between CSV and JSON
CSV Viewer: View, sort and filter CSV files
SQL Formatter: Format and beautify SQL queries
cURL ↔ Fetch: Convert cURL commands to fetch and back
Markdown Editor: Write Markdown with a live preview
Text Cleaner: Remove duplicate lines, empty lines and extra spaces
Find & Replace: Find and replace in any text
Cron Expression Builder: Build and explain cron schedules
User-Agent Parser: Identify browser, OS and device from a user agent
HTTP Headers Inspector: Paste response headers and get them explained
JWT Generator: Create and sign test JSON Web Tokens
Certificate Inspector: Decode PEM certificates and keys
Meta Tag Inspector: Check a page's SEO and social tags
UTM Builder: Build campaign URLs with UTM parameters
URL Cleaner: Strip tracking parameters from links
Robots.txt Generator: Create and test a robots.txt file
Sitemap Generator: Create an XML sitemap from a list of URLs
Image Compressor: Shrink JPEG, WebP and AVIF images in your browser
Image Resizer: Resize images by pixels, percentage or to fit a box
Image Converter: Convert between PNG, JPEG, WebP and AVIF
Image to Base64: Encode images as Base64 data URIs and decode them back
SVG Optimizer: Minify and sanitize SVG files
Favicon Generator: Make favicon.ico, Apple and Android icons from an image or emoji
Color Converter: HEX, RGB, HSL, OKLCH and contrast checks
Number Base Converter: Binary, octal, decimal, hex and float bits
IP / CIDR Calculator: Subnets, masks and IP ranges for IPv4 and IPv6
JSONPath Query: Query JSON with JSONPath expressions
JSON Schema Validator: Validate JSON against a schema, or generate one
Semver Checker: Check versions against semver ranges
chmod Calculator: Unix permissions: rwx ↔ octal
.env Diff: Compare and validate .env files
TOTP Generator: Generate and verify 2FA codes
String Escaper: Escape and unescape strings for any language
Unicode Inspector: See every character, code point and hidden symbol
Mock Data Generator: Generate realistic fake data
QR Code Generator: Create QR codes for links, Wi-Fi and contacts
Lorem Ipsum Generator: Placeholder text in paragraphs, sentences or words
Date Calculator: Date differences, business days and durations
Unit Converter: Convert bytes, lengths, weights, temperatures and more
Query CSV with SQL: Run SQL queries on CSV files
PDF Merge & Split: Merge, split, reorder and rotate PDFs
PDF Metadata Cleaner: See and remove hidden PDF metadata
Office Metadata Cleaner: Remove author and revision data from Word, Excel and PowerPoint
Images to PDF: Combine images into one PDF
Image Editor: Crop, rotate, resize and adjust images
Encrypt / Decrypt Text: Encrypt text with a passphrase (AES-GCM)
SSH Key Generator: Generate Ed25519 and RSA SSH keys locally
Email Header Analyzer: Trace an email's path and check SPF, DKIM and DMARC
JSON to Code: Generate Go, Python, Rust, Java, C# and Kotlin models from JSON
docker run ↔ Compose: Convert docker run commands to docker-compose and back
Color Palette Extractor: Pull the dominant colours out of any image
Password Strength Checker: How long would your password take to crack?
Kubernetes YAML Checker: Validate and explain Kubernetes manifests
.gitignore Generator: Build a .gitignore from presets
CSP Builder: Build and check a Content-Security-Policy
JSON-LD Generator: Create schema.org structured data
Open Graph Image Generator: Make 1200×630 social preview images
CSS Generator: Gradients, shadows, clamp() and more
Time Zone Meeting Planner: Find meeting times across time zones