SPF / DKIM / DMARC Inspector — Email Authentication
Skip to main content
Dev Toolkitby salesforceapp.tech

App

🕐History⚙️Settings1d

SPF / DKIM / DMARC Inspector

Paste any DNS TXT record for SPF, DKIM, or DMARC and get a structured breakdown plus RFC-compliance checks.

No DNS lookups. This tool parses pasted records only. To fetch live records, use the DNS Lookup tool first and pipe the TXT record through.

About SPF / DKIM / DMARC Inspector

Parse and explain SPF, DKIM, and DMARC TXT records. Surfaces RFC violations, SPF lookup-count overages, weak DKIM key sizes, and DMARC policy gaps — without making any DNS requests. Paste the record text directly or pipe it from the DNS Lookup tool.

Pipeline

  • DNS Lookup — fetch live TXT records via DNS-over-HTTPS, then pipe them here.

Frequently asked

What is SPF?
Sender Policy Framework (SPF) is a DNS TXT record that lists the mail servers authorised to send email for your domain. Receiving servers check the SPF record of the envelope sender domain and reject or mark messages from unlisted servers. SPF alone does not prevent spoofing of the From header — that requires DMARC.
What is DKIM?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing messages. The sending server signs the message with a private key; the receiving server verifies the signature using the public key published in a DNS TXT record at <selector>._domainkey.<domain>. DKIM proves the message was not modified in transit.
What is DMARC?
Domain-based Message Authentication, Reporting & Conformance (DMARC) ties SPF and DKIM together and adds a policy: what should receiving servers do with messages that fail both checks? p=none (monitor only), p=quarantine (send to spam), or p=reject (block). DMARC also enables aggregate and forensic reporting so you can see who is sending email on behalf of your domain.
What is the SPF 10-lookup limit?
SPF allows a maximum of 10 DNS lookups per evaluation (include, a, mx, ptr, exists, redirect mechanisms each count as one lookup). Exceeding this limit causes a PermError, which many receivers treat as a fail. If you use many email providers (transactional, marketing, CRM), you can hit this limit quickly. Use SPF flattening or a macro-based SPF record to stay under the limit.
Why does this tool not fetch DNS records automatically?
Fetching live DNS records requires a network request to a DNS-over-HTTPS resolver. This tool is designed to work offline and with pasted records from any source. Use the DNS Lookup tool on this site to fetch TXT records, then pipe them here for parsing.