All Tools

How to Check Your DMARC and SPF Records (and Fix Them)

If your domain has no DMARC record – or one set to p=none – criminals can send emails that look like they come from you. Here is how to check yours in seconds and what to do about it.

🛡️Free Email Spoofing Checker
Can scammers send email as your domain? Check SPF and DMARC in 5 seconds.Open tool →

Check it

Enter your domain in the free Email Spoofing Checker. It reads your public DNS and shows your SPF record, your DMARC record and a plain-English verdict.

What the results mean

SPF lists the services allowed to send email for your domain. DMARC tells receiving mail servers what to do when an email fails those checks.

p=none only reports problems – spoofed emails are still delivered. p=quarantine sends them to spam. p=reject blocks them completely.

How to fix it safely

1) Publish SPF including every service that sends your email (e.g. Google Workspace: include:_spf.google.com). 2) Turn on DKIM signing in your email provider. 3) Add DMARC with p=none and a reporting address. 4) After 2-4 weeks of clean reports, move to p=quarantine, then p=reject.

Frequently asked questions

Is DMARC required?

Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders, and it is the main protection against your domain being used in phishing.

Will DMARC break my email?

Not if you start with p=none and check reports before enforcing.

Where do I add these records?

In the DNS settings wherever your domain is managed – for example Cloudflare, GoDaddy or Namecheap.

🛡️Free Email Spoofing Checker
Can scammers send email as your domain? Check SPF and DMARC in 5 seconds.Open tool →

More guides