Why does my domain need DMARC if I already configured SPF and DKIM?

SPF only verifies the envelope sender (Return-Path), not the user-visible 'From' header displayed in email clients. Attackers can pass SPF checks by using their own return path while spoofing your company's domain in the 'From' address. DMARC enforces domain alignment between the visible 'From' header and SPF/DKIM domains, blocking direct domain spoofing.

What causes the SPF PermError 'Too many DNS lookups'?

RFC 7208 limits SPF evaluations to a maximum of 10 DNS lookups per authorization check. Each 'include', 'a', 'mx', 'ptr', and 'exists' mechanism increments this counter. If your domain's SPF record plus nested includes exceeds 10 lookups, recipient servers return an SPF PermError and may reject or spam-flag legitimate emails. To resolve this, flatten your SPF record or remove redundant email service providers.

What is the difference between DMARC policies p=none, p=quarantine, and p=reject?

The 'p=none' policy puts DMARC in monitoring mode; unauthenticated emails are still delivered to recipient inboxes while generating aggregate reports. The 'p=quarantine' policy instructs recipient servers to deliver unauthenticated emails to the recipient's Spam or Junk folder. The 'p=reject' policy strictly blocks unauthorized emails at the server gateway, providing the highest level of spoofing protection.

What is a DKIM selector and how do I find mine?

A DKIM selector is an arbitrary string that points to the specific DNS TXT record containing your domain's public key (stored at selector._domainkey.domain.com). Selectors allow a single domain to publish multiple DKIM keys for different email providers or rotation cycles. Common selectors include 'google' (Google Workspace), 's1' or 's2' (Microsoft 365), and 'k1'. You can find your selector inside the DKIM settings of your email marketing or cloud mail provider.

What are the new Google and Yahoo email authentication requirements?

Both Google and Yahoo require bulk senders (over 5,000 emails per day) to implement SPF and DKIM, publish a DMARC policy with at least 'p=none', maintain spam complaint rates below 0.3%, and provide one-click unsubscribe headers. Domains that fail these requirements face delivery throttling, spam placement, or outright message rejections.

Utility #20Node.js DNS Resolver

SPF, DKIM & DMARC Checker

Audit your domain's email authentication posture in real-time. Verify SPF syntax and lookup limits, evaluate DMARC enforcement policies, validate DKIM public keys, and inspect MX mail routing.

Loading Email Security engine...

Email Authentication Protocol Guide

The Three Pillars of Modern Email Security

Email spoofing and phishing cost organizations billions each year. Because the original Simple Mail Transfer Protocol (SMTP) lacked built-in identity verification, three interoperable standards were created to authenticate sender identity and protect domain reputation.

1. SPF (Sender Policy Framework)

SPF authorizes specific mail servers by IP address or third-party includes (such as Google Workspace or SendGrid). Recipient mail transfer agents check whether the sending server's IP matches your domain's published SPF record.

2. DKIM (DomainKeys Identified Mail)

DKIM signs outbound messages with an asymmetric private cryptographic key. Recipient mail servers fetch your public key via a DNS TXT record under a specific selector to mathematically verify message integrity and sender legitimacy.

3. DMARC (Policy & Reporting)

DMARC requires alignment between visible "From" headers and SPF/DKIM domains. It instructs receiving mail gateways whether to deliver, quarantine, or reject failing messages, and sends automated telemetry to your reporting address.

Worked Example: Recommended Production DMARC Record

When launching DMARC, begin in monitoring mode (p=none) to collect aggregate reports and identify legitimate services sending on your behalf. Once all legitimate senders pass SPF and DKIM alignment, escalate to enforcement:

# Hostname: _dmarc.example.com

v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@example.com; aspf=r; adkim=r;

p=rejectRejects fraudulent messages immediately at the mail server boundary.

pct=100Applies strict policy to 100% of outbound domain traffic.

rua=mailto:...Receives daily XML aggregate reports detailing sending IPs and pass/fail rates.

sp=rejectProtects non-existent subdomains from spoofed phishing attacks.

Common Email Authentication Pitfalls to Avoid

Multiple SPF Records

Publishing more than one TXT record starting with v=spf1 causes an automatic PermError. Consolidate all mechanisms into a single record.

Exceeding 10 DNS Lookups

Nesting multiple third-party includes can easily cross the RFC 7208 10-lookup barrier. Use our lookup counter to monitor query counts.

Permissive '+all' Directive

Ending an SPF record with +all authorizes every server on the internet to send mail for your domain. Always use -all or ~all.

Stalling at 'p=none'

Leaving DMARC in p=none indefinitely leaves your domain vulnerable to spoofing. Use monitoring reports to fix alignment and graduate to p=reject.

Need to inspect raw TXT or MX DNS zone records?

Explore our dedicated DNS tools to check reported TTL, authoritative nameservers, and zone files.

DNS Lookup TXT Record Guide

Frequently Asked Questions

SPF (Sender Policy Framework) lists the authorized IP addresses allowed to send emails on behalf of your domain. DKIM (DomainKeys Identified Mail) uses cryptographic digital signatures to verify that the email content was not altered in transit. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together by instructing receiving mail servers how to treat emails that fail authentication (none, quarantine, or reject) and sends aggregate deliverability reports back to the domain owner.