DNS Record Validator

How SPF, DKIM and DMARC validation works

These three DNS TXT records work together as layered email-authentication controls. SPF (RFC 7208) lists which servers are allowed to send mail for a domain; DKIM (RFC 6376) lets a server cryptographically sign outgoing mail; DMARC (RFC 7489) tells receivers what to do when SPF or DKIM fail, and where to send reports about it.

SPF evaluation has a hard limit worth watching closely — RFC 7208 caps the DNS lookups a receiver will perform at 10, and each include, a, mx, ptr and exists mechanism (plus a redirect modifier) consumes one:

v=spf1 ip4:192.168.0.0/24 include:_spf.google.com include:mailgun.org ~all

ip4:192.168.0.0/24   → no lookup (IP ranges are free)
include:_spf.google.com → 1 lookup
include:mailgun.org     → 1 lookup
~all                     → no lookup (catch-all, softfail)

Total: 2 of 10 DNS lookups used

This tool tokenizes the record with plain string parsing (no external library) and applies these RFC rules directly — no data ever leaves your browser.

Frequently asked questions

What DNS record types does this tool support?

SPF (RFC 7208), DKIM (RFC 6376) and DMARC (RFC 7489) TXT records — the type is auto-detected from the record's v= prefix.

What is the SPF 10-lookup limit?

RFC 7208 caps the DNS lookups a receiving server performs while evaluating an SPF record at 10, counting each include, a, mx, ptr and exists mechanism plus any redirect modifier. Exceeding it makes the whole check return a permerror, failing all your mail.

What's the difference between DMARC's none, quarantine and reject policies?

none only monitors, taking no action; quarantine delivers failing mail to spam/junk; reject rejects it outright at the receiving server.

Is my DNS record data safe to paste here?

Yes. All parsing happens in your browser with plain JavaScript string parsing; nothing is ever sent to a server.