# DomainCanary > DomainCanary is a DMARC enforcement service that protects your domain from email spoofing without blocking your own mail. The free tools below check and edit SPF, DKIM and DMARC records with no account. ## Product - [DMARC monitoring](https://domaincanary.com/dmarc-monitoring): We read the aggregate reports receivers already send about your domain, list every sender, and mail you the next change to make. Same-day alerts on paid plans. - [Guided enforcement](https://domaincanary.com/guided-enforcement): Reach p=reject one small step at a time. We propose each step when your reports show it is safe, and you approve it before we publish it. With hosted DMARC, a step that blocks your own mail is reverted automatically. - [Hosted DMARC](https://domaincanary.com/hosted-dmarc): We serve your DMARC record through a CNAME in your DNS, so you change the policy and roll it back from your dashboard. - [Hosted SPF](https://domaincanary.com/hosted-spf): We serve your SPF record through an include in your DNS and re-resolve every sender's addresses hourly. - [Hosted MTA-STS](https://domaincanary.com/hosted-mta-sts): Point two CNAMEs at us and we publish your MTA-STS record, serve the policy file and carry its certificate. - [DNS cleanup](https://domaincanary.com/dns-cleanup): See which SPF senders still send mail, from 90 days of your reports, and check every DKIM key you sign with. - [For MSPs and IT providers](https://domaincanary.com/msp): Add every client's domains from a CSV or the API, put each client in its own group, send each client a report under your own name, and move each domain to enforcement. - [All features](https://domaincanary.com/product): Everything DomainCanary does, on one page. - [Pricing](https://domaincanary.com/pricing): Your first domain is free and the free plan does not expire. Paid plans add domains, alerts, guided enforcement and hosted records. - [About](https://domaincanary.com/about): Who runs DomainCanary and how to reach us. ## Tools - [SPF, DKIM and DMARC checker](https://domaincanary.com/tools/spf-dkim-dmarc-checker): Checks a domain's SPF, DKIM and DMARC records in one pass and explains each finding. - [Email health check](https://domaincanary.com/tools/checkup): Checks a domain's DMARC, SPF and DKIM records, its mail servers, the SpamCop blocklist, MTA-STS, TLS-RPT and BIMI, and lists every problem worst first. Each domain has its own address: /tools/checkup/. - [DMARC checker](https://domaincanary.com/tools/dmarc-checker): Looks up and parses a domain's DMARC record: policy, subdomain policy, alignment settings and reporting addresses. - [SPF checker](https://domaincanary.com/tools/spf-checker): Resolves a domain's SPF record, walks every include, and counts DNS lookups against the limit of 10. - [DKIM checker](https://domaincanary.com/tools/dkim-checker): Fetches a DKIM selector's public key, follows CNAME chains, and reports the key algorithm and length. - [SPF change pre-flight](https://domaincanary.com/tools/spf-change-check): Paste an SPF record before you publish it. The tool resolves it against live DNS and lists the senders that would stop passing. - [SPF record generator](https://domaincanary.com/tools/spf-record-generator): Builds an SPF record, or edits an existing one; every mechanism already there is kept byte for byte and the insertion is marked. - [DMARC record generator](https://domaincanary.com/tools/dmarc-record-generator): Builds a DMARC record, or changes the policy in an existing one without touching the rest of it. - [DMARC report analyzer](https://domaincanary.com/tools/dmarc-report-analyzer): Upload a DMARC aggregate report (.xml, .xml.gz or .zip) and read it as a table of sending sources and pass rates. - [Email header analyzer](https://domaincanary.com/tools/email-header-analyzer): Paste the headers of an email you received and see the SPF, DKIM and DMARC results the receiving server recorded, whether each domain matches the From address, and the delay at each server. Nothing is stored. ## Assistants - [MCP endpoint](https://domaincanary.com/mcp): ChatGPT, Codex, Claude and other MCP clients call this endpoint to check a domain's SPF, DKIM and DMARC records, build an SPF record, explain a bounce message and read a DMARC aggregate report, with no account and no sign-in. ## Research - [DMARC Census](https://domaincanary.com/research/dmarc-census): A monthly measurement of DMARC adoption, enforcement and reporting across the Tranco top million, with the aggregate data published under CC BY 4.0. ## Guides - [DMARC setup: from p=none to p=reject](https://domaincanary.com/guides/dmarc-setup): Every step from no record to p=reject, with the numbers I use to decide when each step is safe and what to do when a sender will not align. - [Moving DMARC to p=reject: the checks before each step](https://domaincanary.com/guides/move-to-p-reject): The checks to run against your reports before you tighten DMARC, the record change for each step, and how to roll back fast when a step catches real mail. - [How to read a DMARC aggregate report](https://domaincanary.com/guides/read-a-dmarc-aggregate-report): Open the XML, find the sources that matter, and tell forwarding apart from a misconfigured vendor. A field-by-field walkthrough of a real report. - [SPF's 10-lookup limit: what counts and how to get under it](https://domaincanary.com/guides/spf-10-lookup-limit): Why SPF caps DNS lookups at ten, what each mechanism costs, and the four ways to get back under the limit ranked by how much maintenance they leave you. - [DMARC alignment: why SPF can pass while DMARC fails](https://domaincanary.com/guides/dmarc-alignment): DMARC passes when the From domain matches a domain that SPF or DKIM authenticated. Relaxed and strict alignment, and why forwarding breaks SPF. - [What is DMARC](https://domaincanary.com/guides/what-is-dmarc): What a DMARC record is, why you publish it at p=none first, and how p=reject stops forged mail that uses your exact domain. - [SPF record syntax, term by term](https://domaincanary.com/guides/spf-record-syntax): Every SPF record term checked against RFC 7208: qualifiers, mechanisms, modifiers and macros, each with a valid example record and the lookup it costs. - [Multiple SPF records: why a second one breaks both](https://domaincanary.com/guides/multiple-spf-records): Two v=spf1 records on the same name is a permerror, and permerror fails every sender in both. How to tell if you have two, and how to merge them into one. - [SPF with multiple includes: how many one record can hold](https://domaincanary.com/guides/spf-multiple-includes): Nothing caps how many include: terms an SPF record holds. The 10 DNS lookups they spend between them is the cap, and your record does not show that number. - [Hard bounce vs soft bounce: 5xx refusals and 4xx retries](https://domaincanary.com/guides/hard-bounce-vs-soft-bounce): A hard bounce is a 5xx refusal, a soft bounce is a 4xx retry. Which codes mean the address is gone, which mean your authentication is broken, and how to tell. - [Domain reputation: checking Gmail, Microsoft and the blocklists](https://domaincanary.com/guides/check-domain-reputation): There is no single domain reputation score. Gmail, Microsoft and the blocklists each keep their own. How to check each one, starting with Postmaster Tools. - [Spamhaus delisting: each list and its removal path](https://domaincanary.com/guides/spamhaus-delisting): Spamhaus runs five lists and each has its own removal path. Read the return code to see which one has you, fix the cause, then request removal once. - [Barracuda delisting: the IP list and its removal form](https://domaincanary.com/guides/barracuda-delisting): Barracuda lists IPs, not domains, from spam traps and its own appliances. How to check the list, what the form asks, and why a second request is ignored. - [SPF, DKIM and DMARC: what each one checks and how they fit together](https://domaincanary.com/guides/spf-dkim-dmarc): SPF lists your servers, DKIM signs your mail, and in DMARC you set what a receiver does with mail that fails. How the three fit, and where alignment comes in. - [Email spoofing: how a forged From works, and what stops it](https://domaincanary.com/guides/email-spoofing): The From address on an email is text the sender types. How spoofing works, why the reader can't tell, what DMARC at p=reject stops, and what it doesn't. - [DKIM fail: finding the cause in the email's headers](https://domaincanary.com/guides/dkim-fail): Fix DKIM failures using the email's headers. Check signing, selectors, DNS keys and changed messages, even when a DKIM checker says the record is valid. - [NCSC Mail Check is retired: move your DMARC reports](https://domaincanary.com/guides/ncsc-mail-check-alternative): Mail Check stopped DMARC reporting in March 2025 and closed in March 2026. Check your rua address, choose a free report reader and change that tag only. - [Direct Send spoofing: block it in Microsoft 365, then fix DMARC](https://domaincanary.com/guides/microsoft-365-direct-send-spoofing): Attackers use Direct Send to mail Microsoft 365 users as their own domain. Turn on Reject Direct Send, add connectors, and move DMARC off p=none. - [Emails going to spam: causes at Gmail, Outlook and Yahoo](https://domaincanary.com/guides/emails-going-to-spam): Why your emails go to spam at Gmail, Outlook and Yahoo even when SPF, DKIM and DMARC pass. Check complaints, consent, reputation and content, in that order. - [SPF softfail: what it means, and when to change ~all](https://domaincanary.com/guides/spf-softfail): spf=softfail means the sending server isn't in your SPF record and the record ends in ~all. What receivers do with it, what DMARC does, and which fix applies. - [What is SPF? How the record works and what it can't do](https://domaincanary.com/guides/what-is-spf): SPF is a DNS record listing the servers allowed to send mail for your domain. How receivers check it, why it fails on forwards, and what DMARC needs from it. - [What is DKIM, and what does the selector do?](https://domaincanary.com/guides/what-is-dkim): DKIM signs each message with a private key and publishes the public key in DNS. How the selector finds the key, what the record holds, and how to set it up. - [DMARC policy: what none, quarantine and reject do at the receiver](https://domaincanary.com/guides/dmarc-policy): The p= tag tells receivers what to do with mail that fails DMARC. What Gmail and Microsoft 365 do with each value, plus the sp, np and pct tags. - [Check an SPF change in a pull request before it reaches DNS](https://domaincanary.com/guides/spf-check-pull-request): Fail a DNS pull request when an SPF change drops a sender or breaks the record. A free GitHub Action, with recipes for octoDNS, DNSControl and Terraform. - [Check your domain from ChatGPT or Claude](https://domaincanary.com/guides/check-your-domain-from-chatgpt-or-claude): Add the DomainCanary connector to Claude or ChatGPT by its URL, then ask it to check a domain, build an SPF record, explain a bounce or read a DMARC report. - [35,050 domains list a DMARC report address without authorization](https://domaincanary.com/guides/dmarc-reports-to-nowhere): In our October 2026 scan, 35,050 domains named an outside DMARC report address with no authorization record. See which setups cause it and the fix. ## Error and bounce codes - [550 5.7.515: Outlook rejected your mail for missing authentication](https://domaincanary.com/errors/550-5.7.515): Outlook, Hotmail and Live return 550 5.7.515 when a high-volume sender fails Microsoft's authentication requirements. Publish DMARC and align SPF or DKIM. - [550 5.7.509: Microsoft rejected a message that failed DMARC](https://domaincanary.com/errors/550-5.7.509): Microsoft returns 550 5.7.509 when a message fails DMARC and your own policy says reject. Here's how to tell a misconfigured sender from a genuine spoof. - [550 5.7.26: Gmail blocked your message as unauthenticated](https://domaincanary.com/errors/550-5.7.26): Gmail returns 550-5.7.26 for two different failures: no authentication at all, and a DMARC policy rejection. Tell them apart, then fix the right one. - [550 5.7.1: email rejected per DMARC policy](https://domaincanary.com/errors/550-5.7.1-dmarc): 550 5.7.1 covers several rejections. When the bounce text says DMARC, here's what failed, how to confirm it and what to change at Gmail, Yahoo and elsewhere. - [550 5.7.23: Microsoft 365 rejected your message because SPF failed](https://domaincanary.com/errors/550-5.7.23): Exchange Online returns 550 5.7.23 when SPF fails for the sending IP. Add the missing sender to SPF, and sign with DKIM so forwarded mail passes. - [421 4.7.28: Gmail is rate limiting mail from your IP or domain](https://domaincanary.com/errors/421-4.7.28): 421 4.7.28 means Gmail is throttling your mail for now. Check whether the text says your IP or your domain, then slow down and fix authentication. - [dmarc=fail (p=REJECT): neither passing check matches your From domain](https://domaincanary.com/errors/dmarc-fail-p-reject): Your headers say spf=pass and dmarc=fail because SPF passed for a domain that isn't your From domain. Read the header, then align your sender. - [SPF PermError: too many DNS lookups](https://domaincanary.com/errors/spf-permerror-too-many-dns-lookups): Over ten DNS lookups and your SPF record silently stops passing. Check what counts toward the limit, count your real total, then cut it to ten or below. - [dkim=fail (body hash did not verify): the body changed after it was signed](https://domaincanary.com/errors/dkim-body-hash-did-not-verify): Something altered the message body after signing. Find the hop that edits it, then move signing after that hop so DMARC stops failing. - [Mail Delivery Subsystem: Gmail is reporting a failed or delayed message](https://domaincanary.com/errors/mail-delivery-subsystem): Mail Delivery Subsystem is Gmail's name on a delivery notice. Read Action to see whether Gmail is retrying or stopped, then use Diagnostic-Code to fix it. - [Message blocked: a server refused the message you sent from Gmail](https://domaincanary.com/errors/message-blocked): Message blocked is Gmail's heading on a bounce, and the SMTP line under it says what caused it. Read the status code to find out who has to fix it. - [Delivery Status Notification Failure: Gmail's bounce notice](https://domaincanary.com/errors/delivery-status-notification-failure): Delivery Status Notification Failure is the subject line on a bounce. What it means, how a delay notice differs, and which line gives the cause. - [Email bounced back: a server refused your message](https://domaincanary.com/errors/email-bounced-back): Your email bounced back. Find the one line that gives the reason, then match it to the fix: wrong address, full mailbox, a delay, or a block. - [Your message could not be delivered: Microsoft's bounce notice](https://domaincanary.com/errors/your-message-could-not-be-delivered): Your message could not be delivered is Microsoft's bounce wording. Find the reason sentence, then the SMTP reply sitting underneath it. - [550 permanent failure: the receiver refused your message for good](https://domaincanary.com/errors/550-permanent-failure): A 550 permanent failure is a final refusal. Your server will not retry it. Read the code after the 550, then follow the fix for that code. - [550 5.4.1: the address is not in the recipient's Microsoft 365 directory](https://domaincanary.com/errors/550-5.4.1): Microsoft 365 returns 550 5.4.1 when the address you sent to is not in the recipient's directory. Only an admin at the receiving domain can clear it. - [554 5.7.1: the receiving server refused your message](https://domaincanary.com/errors/554-5.7.1): 554 5.7.1 covers four different rejections, and only one is about DNS. Find the text after the code in your bounce, then follow the section for that text. - [Email quarantined: your message was held at the recipient, with no bounce](https://domaincanary.com/errors/email-quarantined): A recipient says your email was quarantined and nothing bounced. Fix your DMARC alignment first, and ask their admin to release the held copy. - [550 5.1.1: the mailbox at that address does not exist](https://domaincanary.com/errors/550-5.1.1): 550 5.1.1 means the receiving server found no mailbox at that address. Check the spelling, clear your Auto-Complete entry, then write to their admin. - [550 5.7.350: a server past Microsoft 365 refused your message](https://domaincanary.com/errors/550-5.7.350): Microsoft puts 550 5.7.350 in front of another mail server's rejection. The text after the arrow is that server's reply, and it gives the reason. - [550 5.7.520: Microsoft 365 blocked a forward to an outside address](https://domaincanary.com/errors/550-5.7.520): Microsoft 365 returns 550 5.7.520 when a tenant blocks automatic external forwarding. What the bounce means, and who can clear it. - [550 5.2.1: the mailbox exists but is not accepting mail](https://domaincanary.com/errors/550-5.2.1): 550 5.2.1 means the receiving server found the mailbox and it is not accepting mail. Confirm the address, then write to their admin. - [Message not delivered: the recipient's server refused your message](https://domaincanary.com/errors/message-not-delivered): Message not delivered is Gmail's heading. The reason is the line that starts The response from the remote server was. Match that code to its fix here. - [Undelivered Mail Returned to Sender: a Postfix bounce](https://domaincanary.com/errors/undelivered-mail-returned-to-sender): Undelivered Mail Returned to Sender is Postfix's subject line. The reason is on the said: line and in Diagnostic-Code. They show who refused you and why. - [Email delivery failed with no bounce: the receiver accepted your message and held it](https://domaincanary.com/errors/email-delivery-failed): Email delivery failed with no bounce means the receiver accepted the message and filed it in spam or quarantine. The DMARC aggregate report shows it. ## Provider setup - [SPF record for Google Workspace](https://domaincanary.com/spf-record-for/google-workspace): Add include:_spf.google.com to your SPF record, publish Google Workspace's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Microsoft 365](https://domaincanary.com/spf-record-for/microsoft-365): Add include:spf.protection.outlook.com to your SPF record, publish Microsoft 365's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for SendGrid](https://domaincanary.com/spf-record-for/sendgrid): Add include:sendgrid.net to your SPF record, publish SendGrid's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Mailchimp](https://domaincanary.com/spf-record-for/mailchimp): Mailchimp doesn't need include:servers.mcsv.net in your SPF record. Publish its two DKIM CNAME records and a DMARC record, and DMARC passes on DKIM. - [SPF record for HubSpot](https://domaincanary.com/spf-record-for/hubspot): HubSpot has no shared SPF include for your root domain. What to publish instead, how its DKIM signing works, and how to make DMARC align. - [SPF record for Zendesk](https://domaincanary.com/spf-record-for/zendesk): Add include:mail.zendesk.com to your SPF record, publish Zendesk's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Salesforce](https://domaincanary.com/spf-record-for/salesforce): Add include:_spf.salesforce.com to your SPF record, publish Salesforce's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Klaviyo](https://domaincanary.com/spf-record-for/klaviyo): Klaviyo has no shared SPF include for your root domain. What to publish instead, how its DKIM signing works, and how to make DMARC align. - [SPF record for Postmark](https://domaincanary.com/spf-record-for/postmark): Add include:spf.mtasv.net to your SPF record, publish Postmark's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Amazon SES](https://domaincanary.com/spf-record-for/amazon-ses): Add include:amazonses.com to your SPF record, publish Amazon SES's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Intercom](https://domaincanary.com/spf-record-for/intercom): Intercom has no shared SPF include for your root domain. What to publish instead, how its DKIM signing works, and how to make DMARC align. - [SPF record for Brevo](https://domaincanary.com/spf-record-for/brevo): Add include:spf.brevo.com to your SPF record, publish Brevo's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Mailgun](https://domaincanary.com/spf-record-for/mailgun): Add include:mailgun.org to your SPF record, publish Mailgun's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Mailjet](https://domaincanary.com/spf-record-for/mailjet): Add include:spf.mailjet.com to your SPF record, publish Mailjet's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [GoDaddy DKIM, SPF and DMARC records](https://domaincanary.com/spf-record-for/godaddy): Add GoDaddy DKIM, SPF and DMARC records without breaking mail: what goes in Name and Value, the include for GoDaddy email, and why two SPF records fail. - [SPF record for Fastmail](https://domaincanary.com/spf-record-for/fastmail): Add include:spf.messagingengine.com to your SPF record, publish Fastmail's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Mailchimp Transactional](https://domaincanary.com/spf-record-for/mailchimp-transactional): Mailchimp Transactional has no shared SPF include for your root domain. What to publish instead, how its DKIM signing works, and how to make DMARC align. - [SPF record for Campaign Monitor](https://domaincanary.com/spf-record-for/campaign-monitor): Add include:_spf.createsend.com to your SPF record, publish Campaign Monitor's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Constant Contact](https://domaincanary.com/spf-record-for/constant-contact): Constant Contact has no shared SPF include for your root domain. What to publish instead, how its DKIM signing works, and how to make DMARC align. - [SPF record for Zoho Mail](https://domaincanary.com/spf-record-for/zoho-mail): Add include:zohomail.com to your SPF record, publish Zoho Mail's DKIM records, and get DMARC alignment right. With the ten-lookup warning. - [SPF record for Stripe](https://domaincanary.com/spf-record-for/stripe): Stripe has no shared SPF include for your root domain. What to publish instead, how its DKIM signing works, and how to make DMARC align. ## Optional - [Privacy](https://domaincanary.com/privacy) - [Terms](https://domaincanary.com/terms)