Lookup tools and SPF Lookup
The tools under DMARC+ > Tools check what the outside world sees in your DNS. Use them before and after every record change.
The tools
| Tool | Menu item | What it checks |
|---|---|---|
| Domain Scanner | Domain Scanner | Runs DMARC, DKIM, SPF, BIMI and TLS-RPT checks for one domain in a single view |
| SPF | SPF | The SPF record, its includes, and the DNS lookup count |
| DKIM | DKIM | The public key at a selector you enter |
| DMARC | DMARC | The DMARC record and the report addresses |
| BIMI | BIMI | The brand indicator record |
| TLS-RPT | TLS-RPT | The record that requests reports about encrypted delivery problems |
Common layout
Each tool has up to three tabs.
| Tab | Shows |
|---|---|
| Summary | Findings and warnings in plain language |
| Record | The raw record. Shown only when a record exists. |
| Generator | A form that builds a new record |
SPF tool
- Choose Tools > SPF and select a domain.
- Read the Summary tab. The lookup count appears as information below 10 and as an error at 10 or more.
- Open the SPF Record tab to see the record and the tree of includes.
| Finding | Meaning | Fix |
|---|---|---|
| Lookup count at or above 10 | Receivers may treat the record as a permanent error | Remove unused includes or flatten. See What is SPF? |
| No record | SPF is not published | Publish one. |
| Several records | Only one is allowed | Merge them |
DKIM tool
- Choose Tools > DKIM.
- Select the domain and enter the selector.
- Read the Summary.
The DKIM Generator supports 1024 and 2048 bit keys.
DMARC tool
- Choose Tools > DMARC.
- A warning appears if the record has no
ruaorrufaddress. - The report address panel shows the DMARC+ addresses for your organization and domain.
Domain Scanner
- Choose Tools > Domain Scanner and select a domain.
- Select Scan Domain.
- Review each card: DMARC, DKIM, SPF, BIMI and TLS-RPT.
Note: the scanner checks DKIM with a fixed default selector. If your selector is different, the DKIM card may report "not found" even though your record is correct. Use the DKIM tool with your selector instead.
The Email authentication card in Monitoring
On a domain's asset page in Monitoring, Configuration > Email authentication shows SPF, DKIM and DMARC rows. Each row shows Review if a record exists or Set up if not, and opens the same tools. The asset health checklist also flags "No DMARC record" with a Fix action.
Use the tools for these jobs
| Job | Tool |
|---|---|
| Confirm a DNS change has propagated | The matching tool |
| Check a customer's or partner's domain | Domain Scanner |
| Investigate an SPF problem | SPF tool |
| Verify a new sender's key | DKIM tool |
Tip: results reflect live DNS. If you just made a change, allow for caching and try again.