Common SPF and DMARC failures explained

Static explanations of the failures our checker flags most often — usable with JS disabled.

SPF answers “which hosts may send mail using this domain?” Receivers that see more than one v=spf1 TXT often treat SPF as broken. Keep a single record and list only the sources you still use.

Each include, a, mx, ptr, exists mechanism and each redirect modifier counts toward RFC 7208’s limit of ten DNS lookups. Nested includes consumed by receivers also count; our UI estimates from the apex record so you can spot an obvious over-budget policy before flattening.

DMARC tells receivers what to do when SPF/DKIM alignment fails (p=none|quarantine|reject) and where to send XML aggregate reports (rua). Without rua you cannot see whether tightening policy would strand legitimate mail.

DKIM failures are often selector mismatches: the s= in DKIM-Signature must match the published <s>._domainkey name. An empty p= means the key was revoked on purpose.

BIMI logos will not appear in supporting inboxes unless DMARC enforcement is quarantine or reject at pct=100, usually with a verified mark certificate referenced by a=. Use the live checker to confirm prerequisites before asking brand teams for SVG assets.

Open these inputs in the live auth checker