Check a published record
Enter a domain and the lookup reads its TXT records. SPF comes from the domain itself, DMARC from the _dmarc label below it, which is why _dmarc.example.com appears in the query line.
Every term is listed with what it matches and what it costs. An SPF record shows the running lookup count against the limit of 10, and a DMARC record shows each tag translated into the behavior it requests.
The 10 lookup limit
include, a, mx, ptr, exists, and redirect each cost one DNS lookup. ip4 and ip6 cost nothing, which is why hardcoded ranges are the cheap way to authorize a sender.
The count shown here is the record’s own spend. Each include also spends whatever its target record spends, so a domain sitting at 7 can cross the limit because a provider added an include on their end. Past 10, receivers return permerror, and a permerror is treated as no SPF record at all.
p=none is not protection
A DMARC record with p=none asks receivers to report and change nothing. It is the right first step, because the aggregate reports at the rua address show which senders currently fail alignment.
It stops being useful once those reports are clean. Moving to quarantine and then reject is what actually blocks mail that fails both SPF and DKIM alignment.
Alignment is stricter than passing
DMARC checks alignment, which is stricter than SPF or DKIM passing on their own. SPF alignment compares the domain in the SMTP envelope sender with the domain in the From: header. DKIM alignment compares the signing domain with the same header.
Relaxed mode (r) accepts a subdomain match, so mail.example.com aligns with example.com. Strict mode (s) requires an exact match, which breaks the moment a provider signs with a subdomain.
Where records are read from
Both records are plain TXT entries. A TXT record is served as one or more 255-character strings, and a long SPF record split across two strings is rejoined by the receiver before parsing, so the split itself is not an error.
Changes take as long as the record’s TTL to reach receivers that already cached the old value. Lower the TTL before a migration, not during one.
Writing a new record
Reading an existing record and composing one are separate jobs, so they are separate pages. The SPF and DMARC record generator builds the record from controls and writes out the DNS entry to create. Paste the result back here to see it parsed the way a receiver reads it.