No. p=none only collects reports; spoofed mail is still delivered. It is the right first step: read the reports, make sure every real sender passes, then move to p=quarantine and p=reject.

SPF, DMARC & DKIM checker

Q: Why does SPF have a 10-lookup limit?

To stop SPF being used for denial-of-service, receivers stop after 10 DNS lookups from include, a, mx, ptr, exists and redirect. Past that, SPF returns permerror and fails for all mail, so records with many providers often break without anyone noticing.

Q: Who sees the domain I check?

The lookup goes from your browser to Cloudflare's public DNS-over-HTTPS resolver, so Cloudflare sees the domain names queried. Indicia's servers are not involved and nothing is stored.

Look up a domain's SPF, DMARC and DKIM records and see what's wrong: too many SPF lookups, +all, missing or monitor-only DMARC, no reports, weak DKIM keys, with plain-English fixes.

Runs in your browser. The domain name is looked up through Cloudflare's public DNS; nothing is sent to Indicia.

How it works

The page reads the domain's public DNS records: the SPF record, every include it pulls in (counting lookups against the limit of 10), the DMARC record at _dmarc (or the parent domain's, which subdomains inherit), a DKIM key if you give a selector, and whether the domain receives mail. Each problem is explained with the fix.

Need new records? The SPF & DMARC generator builds them.

Questions

What are SPF, DKIM and DMARC?

SPF lists the servers allowed to send email for a domain. DKIM adds a cryptographic signature that proves a message wasn't changed. DMARC tells receivers what to do when a message fails those checks (reject it, send it to spam or just report it) and where to send reports.

Why does SPF have a 10-lookup limit?

To stop SPF being abused for denial-of-service, receivers stop after 10 DNS lookups from include, a, mx, ptr, exists and redirect. Past that, SPF returns permerror and fails for all your mail, so records with many providers often break without anyone noticing.

Is p=none enough?

No. p=none only collects reports; spoofed mail is still delivered. It's the right first step: read the reports, make sure every real sender passes, then move to p=quarantine and finally p=reject.

Why do I need to enter a DKIM selector?

DKIM keys live at selector._domainkey.yourdomain, and DNS doesn't allow listing them. Your provider's setup page gives the selector (for example google for Google Workspace, or selector1 for Microsoft 365), or look for s= in the DKIM-Signature header of an email you sent.

Who sees the domain I check?

The lookups go from your browser to Cloudflare's public DNS-over-HTTPS resolver, so Cloudflare sees the domain names queried. Indicia's servers aren't involved and nothing is stored.