How to Check SPF and DMARC for Every Address on an Email List

To check SPF and DMARC for every address on a list, take the domain after the @ in each address and look up its SPF record and its DMARC record. The bulk email SPF and DMARC checker does that for a pasted list or CSV, up to 100 unique domains a run (500 after a free Google sign-in), and gives each address a row.

It checks the domain, not the mailbox, and a missing record is a flag to look at, not a reason to delete.

Why look at a recipient's records at all?

SPF (RFC 7208) lists the servers allowed to send mail for a domain, and DMARC (RFC 7489) says what receivers should do with mail that fails. A company that runs its own mail normally publishes both. A domain with neither is often one that sends little or no mail, so on a prospect list it separates managed company domains from the rest.

The by-hand way

1. Copy the domain from an address, for example acme.example from sam@acme.example.
2. Look up its TXT records and find the one that starts v=spf1.
3. Look up the TXT record at _dmarc.acme.example and find the one that starts v=DMARC1. If there is none, DMARC also looks at the parent domain.
4. Repeat for every unique domain on the list.

For a few domains, the DMARC checker shows one at a time. For a list, that is a lot of lookups: see how to read a domain's DMARC record for what each tag means.

Step 1: paste the addresses

Paste addresses one per line, or upload a CSV. They are found anywhere in the text, so a whole export works. Only the unique domains are sent, never the mailbox names, 10 a request.

Step 2: run the check

Press Check SPF and DMARC. It is DNS only: no mail is sent and no mail server is contacted.

Step 3: read the result

Result	What it means
SPF and DMARC published	Both records were found and read
No SPF record	The domain publishes no SPF record
No DMARC record	The domain publishes no DMARC record, here or at its parent
No SPF or DMARC	Neither is published
A record needs a fix	A record exists but is invalid, with the reason in the row
DNS didn't answer	A lookup timed out; run the list again

The CSV adds an SPF column, a DMARC column and the DMARC policy (none, quarantine or reject) when one is published.

What this check cannot do

• It checks the domain, not the mailbox. Published records say nothing about whether a person's address exists.
• A domain that only receives mail can have neither record and still deliver every message.
• DKIM is not checked, because it needs a selector.
• Up to 100 unique domains a run without an account, 500 signed in. A timeout shows as DNS didn't answer.

For the domains on their own, use the bulk email authentication checker. To read the three records in context, see SPF, DKIM and DMARC explained.

Next: the mailboxes

Which mailboxes exist is a different question. For a whole list of any size, use the verify page: the first 100 checks are free with a Google sign-in, no card.

Try it now

Paste your list into the bulk email SPF and DMARC checker.