SPF / DMARC / DKIM record parser

Break an SPF, DMARC, or DKIM TXT record into its mechanisms or tags, on your device, with weak-configuration warnings.

SPF / DMARC / DKIM record parser tells the three record types apart by their v= prefix. SPF then splits into mechanisms, DMARC and DKIM into tag=value pairs. SPF is checked against RFC 7208's 10-lookup ceiling and a stray +all; DMARC for p=none or a missing rua; DKIM for an empty p= key. An unmatched record is refused.

Questions

How does it tell the three record types apart?

By the record's own version prefix: v=spf1, v=DMARC1 or v=DKIM1.

What SPF issues does it flag?

A stray +all mechanism, no all mechanism at all, more than one all, and more than 10 DNS-lookup mechanisms, RFC 7208's own limit.

What DMARC issues does it flag?

A missing p= policy tag, p=none (monitor only), and a missing rua tag, which means aggregate reports never get sent.

What DKIM issues does it flag?

A missing p= key, an empty p= key (a revoked key), and t=y (testing mode, where receivers can not enforce failures).

What if the record matches none of the three prefixes?

The tool refuses, naming the three prefixes it expected.

Related Security tools

·→1CVSS calculatorParse a CVSS 3.1 or 4.0 vector string and compute its base score and severity, on your device. 3.1 matches the published formula exactly; 4.0 approximates FIRST's severity table.·→1CSP evaluatorCheck a Content-Security-Policy header for unsafe-inline/eval, wildcard sources, and missing default-src, object-src, or base-uri.1→1security.txt checkerCheck a security.txt file against RFC 9116: required fields, an expired Expires date, and recommended Canonical and Encryption lines.·→1Set-Cookie header parserBreak one or more Set-Cookie header lines into name, attributes, and flags, on your device, with common misconfiguration warnings.·→1URL unfurlBreak a URL into its scheme, punycode-decoded host, and query parameters, on your device, decoding base64-looking values and nested redirect URLs.·→1PKCE code verifier and challengeGenerate an OAuth 2.0 PKCE code verifier and its S256 code challenge, on your device, for an authorization code flow.·→1Webhook HMAC signature verifyCheck a webhook payload against its HMAC signature, on your device, including Stripe and GitHub header formats.