SPF and DMARC Checker: Records, Lookups, DKIM Selector

What Gmail asks of senders

Google's email sender guidelines apply to everyone sending to Gmail accounts, and became mandatory on February 1, 2024. Every sender needs SPF or DKIM for its domain. Senders of more than 5,000 messages a day to Gmail need both SPF and DKIM, a DMARC record (p=none is enough), and a From domain aligned with the SPF or DKIM domain.

Even a small site sends mail: contact forms, password resets, WooCommerce orders, newsletters. If those come from your domain, these records decide whether they arrive.

Reading the SPF result

One record only. A domain must not publish more than one v=spf1 record; with two, SPF returns a permanent error (RFC 7208). Merge them into one.
The all rule at the end: -all fails mail from unlisted servers, ~all marks it as a soft fail, ?all says nothing either way, and +all authorizes every server on the internet, which defeats the point.
The 10-lookup limit. include, a, mx, ptr, exists and redirect each cost a DNS lookup, and SPF must stop with a permanent error after 10. ip4 and ip6 are free. We count your record plus one level of includes, so the real total can be higher when an include has includes of its own.
ptr: the RFC says it should not be used. Replace it with ip4, ip6 or include.

Reading the DMARC result

DMARC lives in a TXT record at _dmarc.yourdomain. DMARC is now defined by RFC 9989 (May 2026), which replaced RFC 7489.

p=none: no preference, just monitoring. A fine place to start, and what Gmail's bulk-sender rule asks for at minimum.
p=quarantine: failing mail should be treated as suspicious, usually the spam folder.
p=reject: failing mail should be refused.
rua: where daily aggregate reports go. Without it receivers send none, and you can't see who sends mail as your domain.
t=y asks receivers to apply a policy one step softer while you test. It replaces the older pct tag.
No record on a subdomain: receivers walk up the DNS tree and use the parent domain's record, so mail.example.com inherits example.com's policy.

DKIM needs a selector

DKIM keys are published at selector._domainkey.yourdomain, and the selector name is chosen by whoever signs your mail, so there's no way to list them. Find it in a message you sent: open the original or raw source and look for s= in the DKIM-Signature header. Google Workspace's default selector is google; other providers show theirs on their DNS setup page.

RFC 8301 says signers must use RSA keys of at least 1024 bits and should use 2048.

Frequently asked questions

Do I need SPF and DMARC if I only send a few emails?

Gmail requires SPF or DKIM from every sender. DMARC is required at 5,000 messages a day, but it costs one TXT record and gives you reports on who sends as your domain, so it's worth adding at p=none.

I use two services that both gave me an SPF record. What do I do?

Combine them into one record: one v=spf1 at the start, both include terms, one all rule at the end. Two separate records make SPF fail for everything.

I'm over 10 lookups. How do I get under?

Remove includes for services you no longer use, replace a and mx with the ip4 or ip6 ranges they point to if those rarely change, and check whether a provider offers a smaller include. Flattening tools that rewrite includes into IP ranges work but must be kept up to date.

When should I move from p=none to quarantine or reject?

When the aggregate reports show all your real mail passing SPF or DKIM with alignment. Moving early sends your own forms and newsletters to spam.

Why does the checker use a different domain than I typed?

Mail records belong to the domain, so we drop a leading www. Enter a subdomain like mail.example.com to check that subdomain.

SPF and DMARC Record Checker