DeveloTools

DNS Record Validator

Validate SPF, DKIM and DMARC TXT records with a plain-English breakdown.

100% client-side

DNS TXT record

0 characters

Breakdown

Unknown
—

What is DNS Record Validator?

SPF, DKIM and DMARC are special DNS TXT records that tell email providers a message really came from your domain and wasn't forged — get one wrong and your legitimate emails can land in spam, or your domain can be spoofed by attackers. DNS Record Validator reads a single SPF, DKIM or DMARC record and breaks it down into a plain-English explanation of what each part does, so you can catch a misconfiguration before it causes deliverability problems.

How to use DNS Record Validator

  1. Paste your DNS TXT record into the DNS TXT record field, or click SPF example, DKIM example or DMARC example to try a sample.
  2. Check the badge above the Breakdown panel — it auto-detects whether the record is SPF, DKIM or DMARC.
  3. Read the Breakdown panel for a plain-English explanation of each mechanism or tag in the record.
  4. Fix any issue flagged in the summary, then re-paste the corrected record to validate it again.

How SPF, DKIM and DMARC validation works

These three DNS TXT records work together as layered email-authentication controls. SPF (RFC 7208) lists which servers are allowed to send mail for a domain; DKIM (RFC 6376) lets a server cryptographically sign outgoing mail; DMARC (RFC 7489) tells receivers what to do when SPF or DKIM fail, and where to send reports about it.

SPF evaluation has a hard limit worth watching closely — RFC 7208 caps the DNS lookups a receiver will perform at 10, and each include, a, mx, ptr and exists mechanism (plus a redirect modifier) consumes one:

v=spf1 ip4:192.168.0.0/24 include:_spf.google.com include:mailgun.org ~all

ip4:192.168.0.0/24   → no lookup (IP ranges are free)
include:_spf.google.com → 1 lookup
include:mailgun.org     → 1 lookup
~all                     → no lookup (catch-all, softfail)

Total: 2 of 10 DNS lookups used

This tool tokenizes the record with plain string parsing (no external library) and applies these RFC rules directly — no data ever leaves your browser.

Frequently asked questions

What DNS record types does this tool support?

SPF (RFC 7208), DKIM (RFC 6376) and DMARC (RFC 7489) TXT records — the type is auto-detected from the record's v= prefix.

What is the SPF 10-lookup limit?

RFC 7208 caps the DNS lookups a receiving server performs while evaluating an SPF record at 10, counting each include, a, mx, ptr and exists mechanism plus any redirect modifier. Exceeding it makes the whole check return a permerror, failing all your mail.

What's the difference between DMARC's none, quarantine and reject policies?

none only monitors, taking no action; quarantine delivers failing mail to spam/junk; reject rejects it outright at the receiving server.

Is my DNS record data safe to paste here?

Yes. All parsing happens in your browser with plain JavaScript string parsing; nothing is ever sent to a server.

Related tools