Back to blog
English (US)Português (Brasil)

Article

How to Check SPF and DMARC Records with Sendrealm

Use Sendrealm to check whether SPF and DMARC records are published, then perform the alignment, DKIM, syntax, and live-message checks it cannot prove.

May 14, 2026Sendrealm TeamEnglish (US)
Image for How to Check SPF and DMARC Records with Sendrealm post

How to Check SPF and DMARC Records with Sendrealm

The free Sendrealm SPF and DMARC checker answers a focused question: does the domain currently publish an SPF record and a DMARC record in DNS?

That quick presence check is useful during setup and troubleshooting, but it is not a complete authentication audit. It does not prove that SPF authorizes the correct service, that DMARC alignment passes for a real message, that DKIM is valid, or that the policy is safe to enforce.

Run the check

  1. Open the Sendrealm SPF and DMARC DNS Verification tool.
  2. Enter the domain, such as example.com, without https:// or a path.
  3. Select Check Domain.
  4. Review the SPF and DMARC results.

The tool queries TXT records on the submitted domain for SPF and under _dmarc for DMARC. A green result means a matching record was found. A missing result tells you where to investigate next.

What an SPF record does

SPF publishes which infrastructure may send using a domain in the SMTP envelope. A typical record begins with:

v=spf1

The rest of the policy can authorize IP addresses and include other providers before ending with a qualifier such as ~all or -all.

Finding v=spf1 is only the first check. A complete SPF review should also confirm:

  • there is one SPF policy, not several conflicting records
  • the current sending provider is authorized
  • removed providers no longer remain authorized
  • the policy stays within the DNS lookup limit
  • the envelope domain is the one expected for the message

Two separate SPF records do not combine automatically. Merge required senders into one valid policy.

What a DMARC record does

DMARC is published at _dmarc.example.com and begins with:

v=DMARC1

It asks receivers to evaluate whether the visible From domain aligns with a domain authenticated by SPF or DKIM. It also publishes a policy such as:

  • p=none for monitoring
  • p=quarantine for suspicious messages
  • p=reject for messages that fail the policy

A found record does not prove alignment. To validate DMARC for a real message, inspect the delivered headers or use a test system that evaluates SPF, DKIM, the visible From, and alignment together.

Why DKIM still matters

The public checker reports SPF and DMARC presence; it does not test a Sendrealm DKIM selector.

DKIM signs messages with a private key and publishes the corresponding public key in DNS. It protects message integrity and can provide the aligned authentication path DMARC needs when SPF does not align.

When configuring a Sendrealm sending domain, copy and verify every DNS record shown in the dashboard, including DKIM-related records. Do not use the public SPF/DMARC checker as a replacement for the domain's Sendrealm verification status.

A useful troubleshooting sequence

SPF missing

  • confirm the domain was entered without a subdomain mistake
  • query the authoritative DNS provider
  • check whether the TXT record was published at the expected host
  • combine with any existing SPF record rather than adding a second policy
  • wait for DNS cache expiration

DMARC missing

  • confirm the host is _dmarc, not the root domain
  • check that the value begins with v=DMARC1
  • remove accidental quotation or hostname duplication introduced by the DNS UI
  • start with a policy appropriate to your monitoring and enforcement plan

Both found, but messages fail authentication

  • inspect the real message's Authentication-Results header
  • confirm the visible From domain
  • confirm SPF and DKIM identity alignment
  • verify the Sendrealm domain and DKIM records
  • check whether another sender is using the domain
  • review forwarding behavior, which can break SPF while DKIM survives

DNS looks correct, but Sendrealm is not verified

Compare every dashboard record with public DNS. Sendrealm domain verification can depend on records beyond the public tool's SPF and DMARC presence check.

Check the right domain

Authentication often involves several domain names:

  • visible From domain
  • envelope or return-path domain
  • DKIM signing domain
  • link-tracking domain
  • organizational root domain

If email comes from notify.example.com, checking only example.com may miss the relevant subdomain policy. Identify the actual message identities before running diagnostics.

Use provider requirements as the baseline

Google requires SPF or DKIM for all senders to personal Gmail accounts and SPF, DKIM, and DMARC for bulk senders. Yahoo publishes comparable authentication and alignment requirements for bulk traffic. Both also require low complaint rates and easy unsubscribe for qualifying marketing messages.

Read the current Gmail sender guidelines and Yahoo sender requirements because authentication rules and enforcement can evolve.

A complete domain audit

Use the Sendrealm checker as step one, then verify:

  • SPF presence and authorization
  • SPF lookup count and single-record structure
  • DKIM selector and signature pass
  • DMARC presence, syntax, and policy
  • SPF or DKIM alignment with the visible From
  • forward and reverse DNS for sending infrastructure where applicable
  • TLS and valid message formatting
  • one-click unsubscribe for qualifying marketing messages
  • complaint, bounce, and reputation signals

A small tool with a clear purpose

The SPF and DMARC checker is valuable because it turns two DNS lookups into a fast, readable signal. Use it to locate missing records, confirm propagation, and begin an investigation. Use Sendrealm domain verification and real-message header analysis to finish the job.