Email authentication: SPF and DMARC
Your DNS also decides who is allowed to send email as you. Two records carry that: SPF lists the servers permitted to send for your domain, and DMARC tells receiving servers what to do when a message fails the check. Domain Monitor Hub reads both during the same daily DNS check — and reports not whether they exist, but whether they actually protect you.
SPF is read from the TXT records already collected for your domain. DMARC takes one extra lookup at _dmarc.yourdomain.com. Both appear on the domain page inside the DNS monitoring card: a verdict, one line explaining what it means, and the record itself.
SPF verdicts
| Verdict | When | What it means |
|---|---|---|
| Missing | no record | Anyone can send email using your domain. |
| Broken | more than one record | The standard allows exactly one. With two or more, SPF fails altogether — though each record looks correct on its own. |
| Enforcing | ends with -all | Mail from servers you haven’t listed is rejected. |
| Soft fail | ends with ~all | Mail from unlisted servers is accepted, but marked. |
| Permissive | ?all, +all or no mechanism | The record doesn’t actually restrict anyone. |
DMARC verdicts
| Verdict | When | What it means |
|---|---|---|
| Missing | no record | Receivers aren’t told what to do with forged mail. |
| Monitoring only | p=none | Reports are collected, but forged mail is still delivered. |
| Enforcing | p=quarantine | Forged mail is sent to spam. |
| Enforcing | p=reject | Forged mail is rejected outright. |
| Policy unclear | no readable p= | A record exists, but the policy can’t be read from it. |
The two cases this exists for
Two SPF records. Both are valid, both look deliberate, and SPF stops applying to your domain entirely. You cannot spot it by reading your DNS — it usually arrives with a mail provider migration where the old record is never deleted.
p=none. The most common DMARC policy there is. The domain counts as DMARC-enabled in any audit, and forged mail in its name keeps being delivered exactly as before.
What reaches you, and what doesn’t
Any change to SPF or DMARC comes to you as part of the DNS change alert — you see what the record was and what it became. A missing record is shown on the domain page but doesn’t generate mail: alerts fire on changes, not on standing state.
What isn’t checked
- DKIM. Deliberately not checked. Its record name contains a selector chosen by your mail provider — google, selector1, k1 and hundreds more — so it can’t be found by guessing. Reporting “DKIM missing” on a domain that has it would be worse than staying quiet.
- DMARC aggregate reports. The policy is read; the rua reports mailed to you are not parsed.
- The SPF lookup limit. An SPF record needing more than ten DNS lookups also fails, and that isn’t counted here.
- MTA-STS, TLS-RPT and BIMI. Out of scope — this is about who may send as you.
Want to check a domain right now, without an account? The free SPF & DMARC checker returns the same verdicts.