SPF and DMARC Domain Security Checker

SPF and DMARC are the two DNS records that determine whether someone can send email that appears to come from your domain. Misconfigured or missing records are one of the most common — and most exploited — gaps in small business email security. This tool checks both live, plus probes for common DKIM selectors, and explains the results in plain language.

Try it now

How to use this tool

1. Enter a domain name (e.g. wuluf.com).
2. Click Check. The tool resolves the SPF record, then the DMARC policy, then probes for common DKIM selectors — each step appears as it completes.
3. Review the verdict banner and the raw records shown underneath.

What SPF and DMARC actually do

SPF (Sender Policy Framework) lists which mail servers are allowed to send email for your domain. DMARC builds on SPF and DKIM to tell receiving mail servers what to do when a message fails authentication — reject it, quarantine it, or let it through. A domain with no DMARC policy, or a weak one, is far easier to spoof convincingly in a phishing attack.

Frequently asked questions

What is SPF?

SPF (Sender Policy Framework) is a DNS record that lists the mail servers authorised to send email on behalf of a domain. Receiving mail servers check this list to help decide whether an incoming message is legitimate.

What is DMARC?

DMARC is a policy record that tells receiving mail servers what to do with messages that fail SPF or DKIM checks — and can also request reports on failed messages, which helps domain owners spot spoofing attempts.

What's the difference between p=reject and p=quarantine?

Both are enforcement policies — reject blocks failing messages outright, quarantine routes them to spam. Many organisations run quarantine deliberately, so a security team can review what's caught before moving to full enforcement. Neither is inherently weaker from a protection standpoint; quarantine is simply an earlier, more cautious stage of the same rollout.